ISO/IEC 27090:2026

International

vISO/IEC 27090:2026, first edition (2026-02)

3 domains

46 controls

ISO/IEC's guidance standard on securing AI systems, built as the practices an organisation applies: an AI security governance programme inside the ISMS, zero trust and secure engineering for AI, supply chain and threat modelling, red teaming, and the detection and mitigation of data poisoning, evasion, membership inference, model exfiltration and inversion, direct model poisoning, sensitive outputs and prompt injection, with the cross-cutting mitigation guidance on interactions, life cycle continuity, deterioration, logging, development environments, input filtering and throttling.

Verified

ISO/IEC 27090:2026 is a compliance framework from International with 3 domains and 46 controls. The largest domains are Clause 6: Types of compromise to AI systems and how each is detected and mitigated – ISO/IEC 27090:2026 (30 controls), Clause 7: Mitigations, their interactions and their continuity across the AI life cycle – ISO/IEC 27090:2026 (9 controls), Clause 5: Applying information security to AI systems (governance programme, zero trust, engineering practice, supply chain, threat modelling, red teaming) – ISO/IEC 27090:2026 (7 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (3)

Clause 5: Applying information security to AI systems (governance programme, zero trust, engineering practice, supply chain, threat modelling, red teaming) – ISO/IEC 27090:2026

7 controls

Controls in the Clause 5: Applying information security to AI systems (governance programme, zero trust, engineering practice, supply chain, threat modelling, red teaming) – ISO/IEC 27090:2026 domain of ISO/IEC 27090:2026: 7 controls
Code	Title	Description
iso-iec-27090-2026::5.1	Security controls applied to AI systems	Information security controls, such as those in ISO/IEC 27002, must be put in place according to organisational needs an...
iso-iec-27090-2026::5.2	Establishing an AI governance programme	An AI governance programme should be set up and operated so that AI systems and their use are properly governed, securit...
iso-iec-27090-2026::5.3	Zero trust principles for AI systems	Zero trust principles should be applied across the AI life cycle as part of secure engineering: assume systems are alrea...
iso-iec-27090-2026::5.4	Software engineering practices for AI	Software engineering best practice, security included, should be applied to AI design and development: automated tests,...
iso-iec-27090-2026::5.5.2	AI supply chain threat assessment	The security of the AI supply chain should be assessed and monitored across the system life cycle, watching the sources...
iso-iec-27090-2026::5.5.5	AI supply chain security measures	Organisations should implement comprehensive AI supply chain security, which means checking provenance of data and model...
iso-iec-27090-2026::5.6	Threat modelling for AI systems	The organisation should use threat modelling as part of information security risk management across the AI life cycle to...

Clause 6: Types of compromise to AI systems and how each is detected and mitigated – ISO/IEC 27090:2026

30 controls

Controls in the Clause 6: Types of compromise to AI systems and how each is detected and mitigated – ISO/IEC 27090:2026 domain of ISO/IEC 27090:2026: 30 controls
Code	Title	Description
iso-iec-27090-2026::6.10.3	Detect output injection attacks	Apply the standard output validation and encoding checks used elsewhere in the estate to model responses before they are...
iso-iec-27090-2026::6.10.4	Mitigate output injection attacks	Apply standard output validation and encoding to model output, and treat that output as untrusted wherever the training...
iso-iec-27090-2026::6.11.2.2	Data minimization	Leave out of the training set any data, fields or records not needed for the application or for sufficient model accurac...
iso-iec-27090-2026::6.11.2.3	Minimal retention	Set a data retention period, enforce it, and delete data once its purpose has ended, including before the period runs ou...
iso-iec-27090-2026::6.11.2.4	Data encryption and obfuscation	Encrypt data, including training data where the system can train on encrypted inputs, obfuscate sensitive fields, and cu...
iso-iec-27090-2026::6.11.2.5	Limit exposure of AI technical details	Access to technical information about AI systems that could help an attacker should be kept to a minimum. Such details s...
iso-iec-27090-2026::6.11.3.1	Determine cause of unwanted model behaviour	Before applying controls against unwanted model behaviour, organisations should establish whether a security attack caus...
iso-iec-27090-2026::6.11.3.2	Human oversight and guardrails	Depending on the risk, organisations should detect and correct or halt unwanted system behaviour using human oversight o...
iso-iec-27090-2026::6.11.3.3	Least privilege for AI agents	Privileges that let a model act on its own should be minimised, with least privilege applied to the agents, services or...
iso-iec-27090-2026::6.11.3.4	Tell stakeholders how the system works	Organisations should give stakeholders relevant information about an AI system, such as its general workings, how it was...
iso-iec-27090-2026::6.11.3.5	Continuous validation against test data	System behaviour should be tested often against a suitable test set so that unwanted behaviour from a long lasting or ha...
iso-iec-27090-2026::6.11.3.6	Explain individual system decisions	Organisations should be able to explain how individual decisions are reached, since this builds user trust, can reduce o...
iso-iec-27090-2026::6.11.3.7	Test for unwanted bias	The system should be tested frequently for unwanted bias, because an attack such as data poisoning or a jailbreak can su...
iso-iec-27090-2026::6.11.4	Provenance for AI systems and data	A provenance scheme should be set up and kept current, covering data used for training and for inference, software depen...
iso-iec-27090-2026::6.2.3	Detect poisoned training data	Watch model performance and data distributions for unusual patterns, investigate them, and use techniques such as trigge...
iso-iec-27090-2026::6.2.4	Mitigate data poisoning attacks	Work on the assumption that training data may already be compromised and sanitise it before use. Combine provenance trac...
iso-iec-27090-2026::6.3.3	Detect evasion attacks	Detect adversarial inputs by running supplemental or parallel networks alongside the main model that watch input and out...
iso-iec-27090-2026::6.3.4	Mitigate evasion attacks	Choose mitigations from the training stage or from testing and operation: adversarial training on clean and manipulated...
iso-iec-27090-2026::6.4.3	Detect membership inference	Detect membership inference attempts through anomaly detection, access pattern auditing and monitoring of model output,...
iso-iec-27090-2026::6.4.4	Mitigate membership inference	Apply differential privacy when producing statistics and training models, and add de-identification, shuffling of traini...
iso-iec-27090-2026::6.5.3	Detect model exfiltration	Watch client query behaviour to spot extraction, using user behaviour analytics against a single caller, extraction thre...
iso-iec-27090-2026::6.5.4	Mitigate model exfiltration	Protect the model with access controls, encryption of its parameters, monitoring for unauthorised access to or downloads...
iso-iec-27090-2026::6.6.3	Detect model inversion	Reuse the query monitoring used against model exfiltration, and treat exploration of the whole prediction space or repea...
iso-iec-27090-2026::6.6.4	Mitigate model inversion	Cap how many queries are allowed and how quickly they arrive, apply differential privacy, de-identification and syntheti...
iso-iec-27090-2026::6.7.3	Detect direct model poisoning	Detect manipulation in development or operation through general security attack detection, and use threat intelligence t...
iso-iec-27090-2026::6.7.4	Mitigate direct model poisoning	Protect the development environment and the running system, for example with a trusted execution environment, manage the...
iso-iec-27090-2026::6.8.3	Detect sensitive model output	Screen model responses for sensitive data recognised by its shape or content, such as a phone number pattern, before the...
iso-iec-27090-2026::6.8.4	Mitigate sensitive model output	Censor recognised sensitive data in model output automatically as described in 6.8.3, and layer output checks, scrutiny...
iso-iec-27090-2026::6.9.3	Detect prompt injection	Detect prompt injection with classifiers that flag harmful content in inputs and outputs, language models used to spot i...
iso-iec-27090-2026::6.9.4	Mitigate prompt injection	Sanitise and validate user prompts with classifiers that filter keywords, limit what the system can reach in untrusted o...

Clause 7: Mitigations, their interactions and their continuity across the AI life cycle – ISO/IEC 27090:2026

9 controls

Controls in the Clause 7: Mitigations, their interactions and their continuity across the AI life cycle – ISO/IEC 27090:2026 domain of ISO/IEC 27090:2026: 9 controls
Code	Title	Description
iso-iec-27090-2026::7.2	Check for conflicting mitigation effects	Mitigations that involve training can interfere with each other and with model accuracy, sometimes increasing exposure t...
iso-iec-27090-2026::7.3	Keep mitigations consistent across the life cycle	Some threats need related mitigations applied at more than one life cycle stage, so organisations should check that the...
iso-iec-27090-2026::7.4	Monitor for mitigation deterioration	Model performance and mitigation effectiveness are expected to decline over time, so ongoing operational monitoring shou...
iso-iec-27090-2026::7.5	Log and monitor model use	Organisations should record and monitor use of an AI model so incidents can be rebuilt afterwards and patterns of attack...
iso-iec-27090-2026::7.6	Protect the development environment	Training and test data, model parameters, source code, configurations and technical documentation in the development env...
iso-iec-27090-2026::7.7.1	Detect out of distribution inputs	Out of distribution inputs differ markedly from training data or are invalid and can signal an attack, so organisations...
iso-iec-27090-2026::7.7.2	Detect adversarial inputs	Tools should be built to spot known attack patterns in single inputs or in a series of inputs. Useful techniques include...
iso-iec-27090-2026::7.8	Throttle model use per user	Access to the model, for example through an API, should be rate limited, preferably per user, to slow attackers who need...
iso-iec-27090-2026::7.9	Limit model size and memorisation	Model capacity should be chosen so the model cannot memorise specifics of any single training example. That makes poison...

What is ISO/IEC 27090:2026 and who does it apply to?

ISO/IEC 27090:2026 is a compliance framework from International with 3 domains and 46 controls. ISO/IEC's guidance standard on securing AI systems, built as the practices an organisation applies: an AI security governance programme inside the ISMS, zero trust and secure engineering for AI, supply chain and threat modelling, red teaming, and the detection and mitigation of data poisoning, evasion, membership inference, model exfiltration and inversion, direct model poisoning, sensitive outputs and prompt injection, with the cross-cutting mitigation guidance on interactions, life cycle continuity, deterioration, logging, development environments, input filtering and throttling. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does ISO/IEC 27090:2026 actually require?

ISO/IEC 27090:2026 has 46 controls organised across 3 domains. The largest domains are Clause 6: Types of compromise to AI systems and how each is detected and mitigated – ISO/IEC 27090:2026 (30 controls), Clause 7: Mitigations, their interactions and their continuity across the AI life cycle – ISO/IEC 27090:2026 (9 controls), Clause 5: Applying information security to AI systems (governance programme, zero trust, engineering practice, supply chain, threat modelling, red teaming) – ISO/IEC 27090:2026 (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of ISO/IEC 27090:2026 do I already cover?

ISO/IEC 27090:2026 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I implement ISO/IEC 27090:2026?

Start your ISO/IEC 27090:2026 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO/IEC 27090:2026 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 46 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,305 frameworks.

Get Started Free →

Free forever, no credit card required