Preparing for ISO 42001 AI Management System Audit

# Annex B Control Categories Relevant to Red Teaming
 
## B.3: AI System Development
- B.3.2: Data quality for AI systems
- B.3.3: AI system development approach
- B.3.4: AI system testing and validation
- B.3.5: AI system documentation
 
## B.4: AI System Operations
- B.4.1: Monitoring of AI systems
- B.4.2: AI system change management
- B.4.3: Third-party AI components
 
## B.6: AI System Security
- B.6.1: Security of AI systems
- B.6.2: Adversarial robustness
- B.6.3: Data security in AI systems
- B.6.4: AI system access control
 
## B.7: AI Risk Management
- B.7.1: AI risk assessment
- B.7.2: AI risk treatment
- B.7.3: Residual risk communication

# Annex B Control Assessment
 
## B.6.1: Security of AI Systems
 
### Control Objective
The organization shall implement security measures to protect AI systems
against unauthorized access, manipulation, and adversarial attacks.
 
### Assessment Criteria
| Criterion | Evidence Required | Red Team Contribution |
|-----------|------------------|----------------------|
| Security measures are documented | Security architecture document | Validate accuracy of documentation |
| Measures protect against unauthorized access | Access control testing results | API auth testing (TC-API-001-005) |
| Measures protect against input manipulation | Adversarial testing results | Prompt injection testing (TC-PI-001-025) |
| Measures protect against data exfiltration | Data security testing results | Exfiltration testing (TC-DE-001-012) |
| Measures are regularly tested | Testing schedule and results | Red team assessment report |
 
### Current State Assessment
| Criterion | Status | Evidence | Gap |
|-----------|--------|---------|-----|
| Security measures documented | Partial | Architecture doc exists but incomplete | Missing adversarial attack coverage |
| Unauthorized access protection | Compliant | Auth testing passed | None |
| Input manipulation protection | Non-compliant | F-001: Prompt injection bypass | Remediation required |
| Data exfiltration protection | Non-compliant | F-003: Cross-tenant leakage | Remediation required |
| Regular testing | Non-compliant | First red team assessment | Testing program needed |
 
### Auditor Questions to Expect
1. "Show me your security testing methodology for AI-specific attacks."
2. "How often do you conduct adversarial testing?"
3. "What were the results of the most recent security assessment?"
4. "How do you verify that remediations are effective?"
5. "What is your process for staying current with new AI attack techniques?"
 
## B.6.2: Adversarial Robustness
 
### Control Objective
The organization shall implement measures to ensure AI systems maintain
intended behavior under adversarial conditions.
 
### Assessment Criteria
| Criterion | Evidence Required | Red Team Contribution |
|-----------|------------------|----------------------|
| Adversarial risks identified | Threat model document | AI threat model assessment |
| Robustness measures implemented | Defense architecture | Test effectiveness of defenses |
| Robustness regularly tested | Adversarial test results | Red team findings and coverage |
| Known vulnerabilities tracked | Vulnerability register | Finding list and remediation status |
 
### Current State Assessment
| Criterion | Status | Evidence | Gap |
|-----------|--------|---------|-----|
| Adversarial risks identified | Partial | General risk assessment exists | AI-specific threat model needed |
| Robustness measures implemented | Partial | Content filter present | Multi-layer defense needed |
| Regular robustness testing | Non-compliant | No prior adversarial testing | Testing program needed |
| Vulnerability tracking | Non-compliant | No AI vulnerability register | Register needed |
 
## B.6.3: Data Security in AI Systems
 
### Control Objective
The organization shall protect data used by, generated by, and stored
within AI systems.
 
### Assessment Criteria
| Criterion | Status | Gap |
|-----------|--------|-----|
| Training data protected | N/A (third-party model) | Document in scope exclusion |
| Knowledge base data classified | Partial | Classification incomplete |
| User data protected in AI context | Non-compliant | F-003: Cross-tenant access |
| System prompts protected | Non-compliant | F-004: Prompt extraction |
| Data retention policies for AI | Compliant | Policy documented and enforced |
 
## B.6.4: AI System Access Control
 
### Assessment Criteria
| Criterion | Status | Gap |
|-----------|--------|-----|
| Role-based access to AI functions | Partial | F-005: Function calling abuse |
| API access controls | Compliant | Authentication verified |
| Admin access restricted | Compliant | Admin controls verified |
| Access logging and monitoring | Partial | Logging exists, monitoring insufficient |

# Evidence Package: B.6.1 Security of AI Systems
 
## 1. Policy Evidence
- AI security policy document (version, date, approver)
- Security architecture document for AI systems
- AI-specific risk assessment
 
## 2. Implementation Evidence
- Content filtering configuration and rules
- Authentication and authorization configuration
- Rate limiting configuration
- Monitoring dashboard screenshots
 
## 3. Testing Evidence
- Red team assessment report (executive summary + findings)
- Test coverage matrix showing AI-specific test categories
- Automated scan results (Garak, Promptfoo)
- Finding remediation tracker
 
## 4. Operational Evidence
- Security monitoring alerts and response examples
- Incident response records (if any AI incidents occurred)
- Change management records for AI system updates
- Vulnerability management records
 
## 5. Continuous Improvement Evidence
- Post-assessment remediation plan
- Scheduled retest dates
- Testing program roadmap

# ISO 42001 Gap Analysis Summary
 
## Overall Readiness
 
| Category | Total Controls | Compliant | Partially | Non-Compliant | N/A |
|----------|---------------|-----------|-----------|---------------|-----|
| B.3: Development | 5 | 2 | 2 | 1 | 0 |
| B.4: Operations | 3 | 1 | 1 | 1 | 0 |
| B.6: Security | 4 | 1 | 1 | 2 | 0 |
| B.7: Risk Management | 3 | 0 | 2 | 1 | 0 |
| **Total** | **15** | **4 (27%)** | **6 (40%)** | **5 (33%)** | **0** |
 
## Critical Gaps (Must Fix Before Audit)
 
| Gap | Control | Impact | Remediation |
|-----|---------|--------|-------------|
| No adversarial testing program | B.6.2 | Major non-conformity | Establish testing program |
| AI vulnerabilities not tracked | B.6.2 | Major non-conformity | Create AI vulnerability register |
| Cross-tenant data access | B.6.3 | Major non-conformity | Fix isolation, verify with retest |
| No AI threat model | B.7.1 | Major non-conformity | Conduct AI-specific threat modeling |
| No AI security monitoring | B.4.1 | Major non-conformity | Implement AI-specific monitoring |
 
## Minor Gaps (Should Fix, Not Audit Blockers)
 
| Gap | Control | Impact | Remediation |
|-----|---------|--------|-------------|
| Security documentation incomplete | B.3.5 | Minor non-conformity | Update documentation |
| Partial data classification | B.6.3 | Minor non-conformity | Complete classification |
| No formal retest schedule | B.6.2 | Minor non-conformity | Add to testing program |

# Pre-Audit Remediation Roadmap
 
## Phase 1: Critical Gap Remediation (Weeks 1-4)
 
### Week 1-2
| Action | Owner | Deliverable | Status |
|--------|-------|------------|--------|
| Fix cross-tenant data isolation | Engineering | Verified fix (retest passed) | |
| Remediate prompt injection findings | Engineering | Updated defense controls | |
| Create AI vulnerability register | Security | Populated register with findings | |
 
### Week 3-4
| Action | Owner | Deliverable | Status |
|--------|-------|------------|--------|
| Conduct AI threat model | Security + ML | Threat model document | |
| Implement AI security monitoring | Security | Monitoring dashboard + alerts | |
| Establish adversarial testing program | Security | Program charter + schedule | |
 
## Phase 2: Documentation and Process (Weeks 5-6)
 
| Action | Owner | Deliverable | Status |
|--------|-------|------------|--------|
| Update AI security policy | CISO | Approved policy document | |
| Complete data classification | Data team | Classification inventory | |
| Update system documentation | Engineering | Accurate architecture docs | |
| Document risk assessment process | Security | Risk management procedure | |
 
## Phase 3: Evidence Collection and Dry Run (Weeks 7-8)
 
| Action | Owner | Deliverable | Status |
|--------|-------|------------|--------|
| Compile evidence packages | Security | Evidence per control | |
| Conduct remediation verification | Red team | Retest report | |
| Internal audit dry run | Quality | Internal audit report | |
| Address dry run findings | All | Corrective actions | |

# Auditor Question Preparation Guide
 
## B.6 Security Controls
 
Q: "How do you test your AI systems against adversarial attacks?"
Prepared Response: "We conduct regular adversarial testing using a
combination of automated scanning tools (Garak, Promptfoo) and manual
expert testing. Our most recent assessment was conducted on [date]
using [N] test cases across [N] attack categories. Results are
documented in our red team assessment report [reference]."
 
Q: "Show me evidence that your security controls are effective."
Evidence: Red team report → findings section → show controls that
held up under testing + show remediated findings with retest results.
 
Q: "How do you handle new AI-specific vulnerabilities?"
Evidence: AI vulnerability register → show process for triaging
new vulnerabilities → show recent example of response.
 
Q: "What is your process when a security finding is identified?"
Evidence: Remediation workflow → finding → severity classification →
remediation → retest → closure in vulnerability register.
 
## B.7 Risk Management
 
Q: "Show me your AI risk assessment."
Evidence: AI threat model → risk scoring matrix → treatment decisions.
 
Q: "How do you determine acceptable residual risk?"
Evidence: Risk acceptance criteria → specific examples of accepted
risks with rationale and senior management approval.