A Catalog of ISO Standards for AI Security

ISO standards for AI security: A catalog of best practices and recommendations

Artificial intelligence (AI) is a rapidly evolving and expanding field that offers tremendous benefits and opportunities for various sectors and domains. However, AI also poses significant challenges and risks for security, privacy, ethics, and trust. Therefore, it is essential to establish and follow standards and best practices for developing and using AI systems securely and responsibly.

The International Organization for Standardization (ISO) is a global body that develops and publishes voluntary standards for various fields and industries, including AI. ISO, in collaboration with the International Electrotechnical Commission (IEC), has established a joint technical committee (JTC 1) for information technology, and a subcommittee (SC 42) for artificial intelligence. These committees are responsible for creating and maintaining standards and guidelines for AI, covering various aspects such as terminology, concepts, architectures, trustworthiness, governance, and security.

In this article, we will provide a catalog of some of the ISO standards for AI security. These standards aim to provide guidance and recommendations for addressing security threats and failures in AI systems, as well as ensuring the security of data, processes, and applications related to AI.

ISO/IEC 27090: Cybersecurity – Artificial Intelligence – Guidance for addressing security threats and failures in artificial intelligence systems

This standard provides guidance for organizations to address security threats and failures in AI systems, throughout their lifecycle, and descriptions of how to detect and mitigate such threats. The guidance in this standard aims to provide information to organizations to help them better understand the consequences of security threats to AI systems, and how to implement security measures and controls to prevent, detect, and respond to such threats. This standard applies to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, that develop or use AI systems.

ISO/IEC 27050-4: Information technology – Security techniques – Electronic discovery – Part 4: Guidelines for security in electronic discovery

This standard provides guidelines for security in electronic discovery, which is the process of identifying, preserving, collecting, processing, reviewing, analyzing, and producing electronically stored information (ESI) for legal or regulatory purposes. The guidelines in this standard cover the security aspects of electronic discovery, such as security policies, roles and responsibilities, risk assessment, security controls, security incidents, and audits. This standard also addresses the security challenges and implications of using AI in electronic discovery, such as data protection, data quality, data integrity, data provenance, data retention, and data disposal.

ISO/IEC 23894: Risk management in information technology and artificial intelligence

This standard provides a framework and a process for managing risks associated with AI systems, based on the principles of ISO 31000: Risk Management – Guidelines. The framework and the process in this standard help organizations to identify, analyze, evaluate, treat, monitor, and communicate the risks related to AI systems, as well as to establish and maintain a risk management culture and a risk management policy for AI systems. This standard also provides guidance and examples for applying the framework and the process to different types and domains of AI systems.

ISO/IEC 38507: Information technology – IT governance – Implications for governance in the application of AI by organizations

This standard provides guidance for governing the use of AI by organizations, based on the principles of ISO/IEC 38500: Information technology – Governance of IT for the organization. The guidance in this standard helps organizations to ensure that their use of AI is aligned with their objectives, strategies, values, and policies, as well as with the legal, ethical, and social norms and expectations. This standard also provides guidance and examples for applying the governance principles and the governance model to different types and domains of AI systems.

Conclusion

ISO standards for AI security are important and useful for organizations that develop or use AI systems, as they provide guidance and recommendations for addressing security threats and failures in AI systems, as well as ensuring the security of data, processes, and applications related to AI. ISO standards for AI security also help organizations to manage the risks and the governance implications of using AI, as well as to comply with the legal, ethical, and social requirements and expectations for AI.