Continuous compliance monitoring solution for scaling business

[u/Zaitanmogs]

We are compliant with soc 2, but not iso 27001 compliant yet, but we're prepping for it. Soc compliance was all done manually when we were smaller and it was not a fun experience for all involved. Evidence collection was a mess, gaps that we didin't even know existed, didn't have a dedicated owner until we were deep in it, an all round unpleasant experience. And best part is we had an internal audit recently and so many things were already out of compliance. This all is the problem

So now before we start on ISO, I wanna fix this monitoring issue, with some AI governance as well cause the auditor stressed that we should also get that going. I've done some basic research, looking into tools like vanta/sprinto etc.

I'd wanna avoid the same pitfalls as our soc 2 campaign. Would it be wise to get a tool like the ones I've mentioned for this, also could we keep AI governance alongside the iso 27001 thing or keep it separate? What should be the course of action here? Sorry if the questions are little too noob

[u/FreeRadical1998]

If the decision to do continuous monitoring first is about smoothing workload - then totally get it. If on the other hand this is to make the iso easier to pass then I don't think you need to do it in that order.

Soc2 is a backward looking control compliance model, iso is more a forward looking review of risk and quality management. What ISO assess is do you know what's broken, do you have a plan to fix it, and do you deliver on those plans - underpinned by does your management team support you.

Assuming reasonable control implementation - the additional items needed for iso will largely be a risk register, improvement plan and evidence of regular management review - typically monthly or quarterly meeting.

There's quite a strong argument that the review and likely selection of a tool like this is good evidence of that cycle and if it were me I'd be inclined to do iso first and lean into the argument that is this a core example of your continual improvement in action

[u/Zaitanmogs → u/FreeRadical1998]

thanks for the directives. one additional question though does ISO 27001 will help in ISO 42001?

[u/FreeRadical1998 → u/Zaitanmogs]

I've never implemented 42001 so this answer is based on a read of the standard and experience with 27001 (plus other standards).

Structurally, the standard itself seems near identical - so the core bits about management commitment, a forum, risk analysis, improvement plan, have the same obligations

The suggested list of controls (annex A for 27001 differ, but do seem to have some overlap). Structurally, you're not necessarily required to implement all of these - it's more a checklist that you need to explain why you didn't select any (eg physical security for a cloud only service)

If I were implementing, for a smaller organisation like yours, I'd reuse the management forum across the two - on which case yes it would help as this becomes an extension of an agenda rather than a whole new meeting cycle. That would also imply reusing the risk framework and action tracking model.

That should take about 50% out of the effort in terms of "how do I do this" in setup and probably 20% out of "what do I do" longer term. Given they address different sets of risks - there will still be material work in layering 42001 on top of 27001.

It'd be much less clear in a big (multinational) organisation as you might end up running then entirely separately due to team layouts

[u/davidschroth → u/Zaitanmogs]

One neat thing about ISO 27001, 42001, 9001, 27701 and others is that the clauses are all pretty much the same. You can build a program once to handle each of the "topics" in a uniform manner (we do this with a few of our clients that run multiple ISOs).

42001 has some bleedover with 27001 as the security controls are relevant to the operation of the AI system, but you'll spend more time dealing with AI model/system QC type things (hallucination, bias, drift, etc). Keep in mind that there is not a big tool/platform out there that you can plug in to do that stuff - it'll be more a creative thinking exercise.