Applicability: AI Developers, Operators and Security Teams
AI Threat Detection and Mitigation Program
Speak to a GRC expert
If you have any questions or need assistance, please don't hesitate to contact us.
Who Should Apply It
ISO/IEC 27090 is relevant to organizations of every size that develop, procure or use AI systems.
AI System Owners
Accountable teams defining AI use cases, acceptable risk and security priorities.
AI Development Teams
Engineers designing, training, integrating and maintaining AI models and pipelines.
Security Leadership
Cybersecurity leaders coordinate threat assessments, controls and response readiness.
Model Risk Owners
Assigned stakeholders track material exposures and validate security decisions.
AI Assurance Teams
Specialists assess AI attack surfaces, evidence and mitigation effectiveness.
Operational Oversight
Security, data and engineering teams cooperate as threats and models evolve.
Mapping AI Security Responsibilities Across the Lifecycle
ISO/IEC 27090 informs coordinated protection of AI data, models, workflows and deployment environments.
Asset Ownership
Designated owners maintain visibility into AI components, exposure and changes.
Engineering Safeguards
Development teams secure training pipelines, model artifacts and integrations.
Operational Security
Operators monitor inputs, outputs and unusual model access patterns.
Security Governance
Risk owners coordinate testing, escalation and remediation across teams.
Core Activities for AI Developers and Operators
Effective AI security requires coordinated controls and continuous risk review.
- AI Asset Inventory
- Threat Modeling
- Adversarial Testing
- Model Provenance
- Provider Oversight
- Security Monitoring
- Access Segmentation
- Secure Model Updates
- Inference Protection
- Incident Preparedness
Related pages
Continue Reading
Ready to learn more about AI Threat Landscape, Exposure and Business Impact?