CART
The ISO 27090 Toolkit gives you 61 editable Microsoft Office templates for securing AI systems: 42 Word documents and 19 Excel workbooks built on the clause structure of ISO/IEC 27090:2026. Each of the 118 recommendations we derived from it is answered by a named document. It covers data poisoning, evasion, prompt injection, model extraction, membership inference and model inversion, plus AI agents, supply chain, provenance and red teaming. A crosswalk maps the pack to ISO/IEC 27002, ISO/IEC 42001, EU AI Act Article 15, NIST AI 100-2 and the OWASP Top 10 for LLM Applications.
$99.00
✓ In stock — instant download after checkout
ISO/IEC 27090:2026 is the ISO/IEC guidance on how AI systems get attacked and how to defend them. It covers poisoned training data, adversarial inputs, prompt injection, extraction of models and their training data, tampered model files, and agents with more power than they should have. For each threat it explains what fails, how to detect it and how to mitigate it.
What it does not give you is anything to implement. It is written as guidance, in prose. The ISO 27090 Toolkit turns that guidance into the policies, standards, procedures, registers and test records a security team actually runs, organised on the standard’s own clauses so you can lay any document beside the subclause it answers.
ISO/IEC 27090 contains 2 requirements (both in 5.1) and is otherwise recommendations. Nobody can certify you against it. If someone offers “ISO 27090 certification”, ask what they are certifying.
What it is good for is evidence. The ISO 27090 Toolkit is built to sit inside a certifiable system you already run or are building:
The standard’s advice is written as running text. We broke it into 118 numbered recommendation references: 2 requirements, 97 recommendations and 19 guidance points. Each one names the document in this pack that answers it.
Every Word document opens with a Recommendations addressed table that lists the references it answers and the section where it answers them. The build fails if any recommendation, or any of the 86 subclauses the pack tracks, is left without an owner. Annex B is tracked at its second level, so that covers all 101 leaf subclauses of the standard, and an independent QA review checked the 101 separately. That is a check we run, not a claim we make.
The Gap Assessment and Applicability Workbook ships pre-loaded with all 118, a status and evidence column for each, a not-applicable justification column, and a summary by part of the standard that calculates itself.
ISO/IEC 27090 points to ISO/IEC 27002 and ISO/IEC 42001. It says nothing about the EU AI Act, NIST’s adversarial machine learning taxonomy or the OWASP Top 10 for LLM Applications. The ISO 27090 Toolkit’s Framework Crosswalk covers all five:
| Framework | What the crosswalk uses |
|---|---|
| ISO/IEC 27002:2022 | 52 of the 93 controls, by number and title |
| ISO/IEC 42001:2023 | 28 of the 38 Annex A controls |
| EU AI Act | Article 15 (accuracy, robustness and cybersecurity), including the 15(5) duties on data poisoning, model poisoning, adversarial examples and confidentiality attacks |
| NIST AI 100-2e2025 | The NISTAML attack identifiers and mitigation sections |
| OWASP Top 10 for LLM Applications | LLM01:2025 to LLM10:2025 |
Every mapping row carries a confidence rating, because a mapping is an interpretation. The mappings to the EU AI Act, NIST and OWASP are ours, and the workbook says so.
Article 15 applies to high-risk AI systems. After the 2026 Digital Omnibus those obligations apply from 2 December 2027 for Annex III systems. If that is you, pair this pack with the EU AI Act Toolkit. If your programme runs on the NIST AI RMF, the NIST AI RMF Toolkit is the governance companion.
Clause 6 describes each compromise type in the same four parts: description, failures, detection and mitigation. Each threat standard in the ISO 27090 Toolkit follows that order, then adds what the standard leaves to you:
The AI Compromise Type Catalogue lists the 12 compromise types the standard describes in detail, plus jailbreaking and insecure code generation from its Table 1, with the asset and security property each one hits first, whether it needs an attacker, and whether it applies to generative AI, predictive AI or both.
Clause 7 of ISO/IEC 27090 deals with something easy to overlook: mitigations interfere with each other, and they decay. Training a model to resist one kind of adversarial input can leave it more exposed to another.
The ISO 27090 Toolkit treats that as a managed process. The Mitigation Portfolio Management Procedure sets the selection criteria (effectiveness, resilience, durability, cost, maturity). The Mitigation Interaction and Efficacy Assessment re-measures model performance and every other mitigation, not just the new one, before any change is deployed.
.invalid domains, so a fail is unambiguous and nothing real leaves the building.Pre-trained models, public datasets, ML libraries and notebook plugins are all routes in, as clause 5.5 of the standard sets out. The ISO 27090 Toolkit includes an AI Supply Chain Security Procedure, a Third-Party Model and Dataset Intake Assessment, a contract-ready AI Supplier Security Schedule, a Model File and Backdoor Security Standard covering formats that can run code on load, and an AI Provenance and AI-BOM Register for datasets, models and lineage.
The AI Detection Use-Case Catalogue turns the standard’s detection guidance into 21 monitoring use cases: probing near a decision boundary, extraction-pattern queries, dataset hash mismatches, writes to retrieval stores, system-prompt text appearing in output, agents attempting out-of-scope actions. Each has a data source, a threshold to set from your own baseline, and a response. The AI Security Incident Response Playbook gives the first actions for each compromise type.
| # | Section | Documents |
|---|---|---|
| 00 | Start Here | 4 |
| 05 | Information Security for AI | 15 |
| 06 | Compromise Types | 26 |
| 07 | Mitigations | 10 |
| 08 | Annexes A to C | 6 |
The ISO 27090 Toolkit is 42 Word documents and 19 Excel workbooks. Section 05 follows clause 5, section 06 clause 6, section 07 clause 7, and section 08 Annexes A to C.
ISO/IEC 27090 is a licensed standard. The ISO 27090 Toolkit cites subclause numbers and short names, and states what each recommendation asks for in our own words. We check that mechanically: the shipped files were compared against the standard’s text, and no run of eight or more words matches outside its title, its headings and the ISO/IEC 27002 control names. Buy the standard from ISO or your national standards body for the authoritative text.
00 — Start Here (4 documents)
05 — Information Security for AI (15 documents)
06 — Compromise Types (26 documents)
07 — Mitigations (10 documents)
08 — Annexes A to C (6 documents)
The ISO 27090 Toolkit is a set of 61 editable Microsoft Word and Excel templates for securing AI systems: 42 documents and 19 workbooks. They are organised on the clauses of ISO/IEC 27090:2026, cover all 101 of its leaf subclauses, and answer each of the 118 recommendation references we derived from it.
No. ISO/IEC 27090 is guidance with 2 requirements, not a management system standard, and there is no certification scheme for it. Use the ISO 27090 Toolkit to evidence AI security within an ISO 27001 or ISO 42001 programme, which can be certified.
We recommend it. The ISO 27090 Toolkit is usable on its own because every recommendation is stated in our own words, but it does not reproduce ISO’s text, and an assessor may want to see that you have read the source.
ISO 42001 is the management system: AI policy, objectives, impact assessment, roles, audit and review. ISO/IEC 27090 is the security engineering underneath: what attacks AI systems face and which controls stop them. The ISO 42001 Toolkit does the first, the ISO 27090 Toolkit the second, and the ISO 27090 Toolkit’s governance charter shows how they fit together without duplication.
Yes, for Article 15. The crosswalk maps the pack to Article 15(1), (3), (4) and (5), including the specific attack classes 15(5) names. Article 15 is one of several high-risk obligations; for the rest, see the EU AI Act Toolkit.
Yes, though not all of it. Prompt injection, output handling, sensitive output, agent privileges, data leakage, supplier intake and logging all apply to systems built on a hosted model. The documents for training-time threats can be marked not applicable in the gap assessment, with the reason recorded.
Microsoft Word (.docx) and Microsoft Excel (.xlsx), 42 and 19 respectively. Every ISO 27090 Toolkit file is fully editable, unlocked and unprotected. The workbooks have drop-down validation, frozen headers, autofilters and worked example rows flagged for deletion.
With the Read Me and Implementation Roadmap. It sets out six phases: inventory, assessment, baseline, treatment, operation and improvement. Begin with the AI System Security Inventory and the gap assessment, because they decide which threat standards apply to you.
Implementing for clients? The Consultant Package bundles 89 toolkits — 8,100+ editable templates — under one firm-wide licence that covers unlimited client engagements. $1,399 one-time.
Free articles that explain the requirements this toolkit covers.
Reviews
There are no reviews yet