What Is ISO/IEC 27090:2026?

ISO/IEC 27090:2026, titled Cybersecurity — Artificial Intelligence (AI) — Addressing Security Threats and Compromises to AI Systems, focuses on cybersecurity threats specifically associated with artificial intelligence.

Unlike traditional software, AI systems depend on training data, algorithms, models and continuous interactions with users and other systems. These components introduce security risks that require additional attention.

The standard helps organisations:

• Understand AI-specific cybersecurity threats and vulnerabilities.
• Identify potential security compromises across the AI life cycle.
• Evaluate the consequences of attacks on AI systems.
• Consider appropriate threat detection and mitigation measures.
• Strengthen AI security through existing cybersecurity practices and additional AI-specific safeguards.

The guidance applies to organisations of all sizes that develop or use AI systems.

Key Cybersecurity Threats Addressed by ISO/IEC 27090:2026

1. Data Poisoning

Attackers may manipulate training data to influence how an AI model behaves, potentially causing inaccurate predictions, unreliable decisions or malicious outcomes.

2. Model Theft and Exfiltration

AI models can contain valuable intellectual property. Attackers may attempt to steal model files or reconstruct model behaviour through repeated interactions.

3. Prompt Injection Attacks

Malicious instructions embedded in user inputs or external content may manipulate AI systems into producing unintended responses or performing unauthorised actions.

4. Model Evasion Attacks

Attackers may craft inputs designed to bypass AI-based detection or classification mechanisms, reducing the reliability of security-sensitive AI applications.

5. Sensitive Information Exposure

AI systems may unintentionally reveal confidential information through model outputs, training-data leakage or attacks intended to extract sensitive information.

6. AI Supply Chain and Life Cycle Risks

Security vulnerabilities may arise from third-party models, training datasets, development environments, integrations and model updates.

ISO/IEC 27090:2026 encourages organisations to consider these risks across AI development, deployment, operation and maintenance.

How Does ISO/IEC 27090 Relate to ISO 27001 and ISO 42001?

ISO/IEC 27090:2026 complements existing international standards by providing more specific guidance on AI-related security threats.

Together, these standards can help organisations develop a more comprehensive approach to information security, AI governance and AI-specific cybersecurity risk management.

Important: ISO/IEC 27090:2026 is a guidance standard. It does not establish a separate certifiable management system comparable to ISO/IEC 27001 or ISO/IEC 42001.

What Should Organizations Do?

Organizations developing or using AI should consider the following practical steps:

Identify AI Assets: Maintain visibility over AI applications, models, datasets, integrations and third-party AI services.

Assess AI Security Risks: Evaluate threats such as data poisoning, prompt injection, model theft and sensitive information exposure.

Review Existing Security Controls: Assess whether existing cybersecurity policies and controls adequately address AI-specific risks.

Strengthen AI Security Testing: Consider AI threat modelling, adversarial testing and security validation appropriate to the organisation’s AI systems.

Implement Monitoring and Incident Response: Establish mechanisms to detect suspicious AI behaviour and respond to potential compromises.

Integrate AI Security into Governance: Align AI-specific cybersecurity activities with existing ISMS, AIMS and enterprise risk management processes.

How MAST Consulting Group Can Help

At MAST Consulting Group, we help organisations strengthen their cybersecurity, information security governance and AI management practices.

Our consulting services can support organisations in adopting the guidance of ISO/IEC 27090:2026 through:

AI Security Gap Assessment

Evaluate existing cybersecurity controls and identify gaps related to AI-specific threats and vulnerabilities.

AI Risk Assessment and Governance

Support the identification, assessment and treatment of AI security risks through structured governance and risk management frameworks.

ISO/IEC 27001 and ISO/IEC 42001 Alignment

Help organisations integrate AI security considerations into their existing Information Security Management System and Artificial Intelligence Management System.

AI Security Policies and Procedures

Develop or enhance relevant policies, procedures, risk registers, security assessment methodologies and incident response processes.

Security Readiness and Continuous Improvement

Support security reviews, corrective action planning and ongoing improvements to AI cybersecurity practices.

Building Secure and Responsible AI Systems

As AI adoption continues to accelerate, securing AI systems is becoming an important part of organisational cybersecurity and risk management.

ISO/IEC 27090:2026 provides organisations with a structured reference for understanding AI-specific threats and improving security measures throughout the AI life cycle.

By combining established information security practices with AI-specific risk management, organisations can improve their ability to identify vulnerabilities, protect valuable assets and respond to emerging threats.

Strengthen Your AI Security with MAST Consulting

Is your organisation prepared to address the cybersecurity risks associated with artificial intelligence?

Contact MAST Consulting Group to explore how our cybersecurity, AI governance and ISO consulting services can help strengthen your organisation’s AI security posture.

Official Reference: https://www.iso.org/standard/27090