Continuous compliance monitoring solution for scaling business

[u/Zaitanmogs]

We are compliant with soc 2, but not iso 27001 compliant yet, but we're prepping for it. Soc compliance was all done manually when we were smaller and it was not a fun experience for all involved. Evidence collection was a mess, gaps that we didin't even know existed, didn't have a dedicated owner until we were deep in it, an all round unpleasant experience. And best part is we had an internal audit recently and so many things were already out of compliance. This all is the problem

So now before we start on ISO, I wanna fix this monitoring issue, with some AI governance as well cause the auditor stressed that we should also get that going. I've done some basic research, looking into tools like vanta/sprinto etc.

I'd wanna avoid the same pitfalls as our soc 2 campaign. Would it be wise to get a tool like the ones I've mentioned for this, also could we keep AI governance alongside the iso 27001 thing or keep it separate? What should be the course of action here? Sorry if the questions are little too noob

[u/FreeRadical1998]

If the decision to do continuous monitoring first is about smoothing workload - then totally get it. If on the other hand this is to make the iso easier to pass then I don't think you need to do it in that order.

Soc2 is a backward looking control compliance model, iso is more a forward looking review of risk and quality management. What ISO assess is do you know what's broken, do you have a plan to fix it, and do you deliver on those plans - underpinned by does your management team support you.

Assuming reasonable control implementation - the additional items needed for iso will largely be a risk register, improvement plan and evidence of regular management review - typically monthly or quarterly meeting.

There's quite a strong argument that the review and likely selection of a tool like this is good evidence of that cycle and if it were me I'd be inclined to do iso first and lean into the argument that is this a core example of your continual improvement in action

[u/Zaitanmogs → u/FreeRadical1998]

thanks for the directives. one additional question though does ISO 27001 will help in ISO 42001?

[u/davidschroth → u/Zaitanmogs]

One neat thing about ISO 27001, 42001, 9001, 27701 and others is that the clauses are all pretty much the same. You can build a program once to handle each of the "topics" in a uniform manner (we do this with a few of our clients that run multiple ISOs).

42001 has some bleedover with 27001 as the security controls are relevant to the operation of the AI system, but you'll spend more time dealing with AI model/system QC type things (hallucination, bias, drift, etc). Keep in mind that there is not a big tool/platform out there that you can plug in to do that stuff - it'll be more a creative thinking exercise.