ISO/IEC 27001

ISO 42001 is a voluntary AI management standard.

It's related in spirit to ISO 27001, but it focuses on how an organization governs AI.

It asks useful questions.

Which systems do you use? Why? Who owns them? What data enters them? What decisions do they influence? How do you handle performance, bias, security, human oversight, and review? All the questions

Well, I think the main thing that we think about is making sure data governance is in place because when communities or when organizations are sharing data, you have to be really secure.

So we have ISO 27001 accreditation.

We manage data governance right down to the actual variable and who – and what gets shared with whom and how that gets shared, then we manage data sovereignty, not only where data is stored but importantly First Nations data sovereignty because much of this is also supporting First Nations, you know, self-determination as well as community.

Self-determination, when you talk about decisions from the grassroots up, democratisation, and data and evidence is critical as part of that.

By adopting NIST, a CISO can look the board of directors in the eye and prove that their security strategy covers every phase of an attack lifecycle.

Next is ISO 27001.

While NIST is a structural guide, ISO is an international standard that you can actually be certified against.

Here is a secret that separates the mid-level managers from the global executives.

So I left.

I joined a phenomenal company where I helped them get ISO 27001 certified.

But ultimately felt like I always had this burning need that I wanted to solve that alert overload problem.

And I started talking to CISOs and security professionals to understand, was it just me? Could I not hack it? Or was this actually a problem? And it turned out that 50% of security leaders wanted to quit and 25% wanted to leave the industry.

I've ticked this box.

This meets the requirements of ISO 27001 or the CRA or NIST or whatever bit of legislation or regulation that we want to pick.

And then you go to the board and say, I've done this.

Thank you for the million dollars, million pounds, million euros.

for sure i've used ai uh cloud code uh my company lets us use it so i use it to create a web app that basically uh lists the cis top 18 control implementation group one and what we have an organization with a what a variable what uh exactly and i showed it to my manager he showed it to the guys and i don't even want to I don't want to talk too much, but I showed it to the people in the upper leadership, and they actually liked it.

They want to do more for the benchmark, like ISO 27001, so it helps.

I think that's a new word.

After that, they told me that they need me not to be too technical, but know what they want and be able to deliver.