SRIDA-AIS-27090-RTP-001 · Version 1.0 · 371 pages · by Rajendra Bodda, CISO
ISO/IEC 27090:2026 AI Security — Guidance, Controls & Assurance Testing Procedures
Turn new AI security guidance into controls you can test.
371
pages
24
testable controls
12
guidance areas
Why this manual matters
ISO/IEC 27090 addresses security threats and failures specific to AI systems — poisoning, evasion, model extraction, membership inference and more. Because it is guidance rather than a certifiable requirements standard, organisations struggle to turn it into something auditable.
This manual is threat-led. It explains the AI compromise types, organises practical guidance into twelve areas, and sets out a 24-control Srida IT control set mapped to the 27090 threats and to ISO/IEC 27001 and ISO/IEC 42001 Annex A — so AI security evidence can be reused in the audits you already run.
A dedicated assurance part covers AI red teaming and how to present 27090-aligned evidence inside ISO/IEC 27001 and 42001 certification audits.
What’s inside
Threat chapters
Each AI compromise type explained with attack paths, indicators and the controls that address it.
12 guidance areas
Applying information security to AI in practical, testable terms.
24-control set
Srida IT controls AIS-01 to AIS-24 with tests, mapped to 27090 threats and 27001 / 42001 Annex A.
AI security assurance
Red teaming, assurance evidence and integration with certification audits; threat-to-control matrix.
Who it is for
- Security architects and AI/ML engineers
- CISOs extending an ISMS to AI systems
- Penetration testers and red teams moving into AI
- Auditors assessing AI security controls
Preview before you buy
The free sample has 12 pages: the cover and document control pages, the opening of the contents, the start of Chapter 1 and one complete requirement entry with its testing procedures.
Open the sample PDF in a new tab →How you receive it
- Pay ₹970 by UPI QR and enter your UPI reference at checkout.
- We verify the payment against our bank record, usually within one business day.
- You receive an email with a secure download link (valid 30 days, up to 5 downloads; you can request a fresh link any time).
- Your PDF is stamped with your name, email and a unique licence code on every page.
- For 12 months, every new version of this manual is emailed to you automatically.
Please note
Independent Srida IT guidance. ISO/IEC 27090 is a guidance standard and is not certifiable; the 24 controls are Srida IT's. This manual does not reproduce or replace the licensed text — confirm detailed points against your copy.
Purchases are subject to the Terms and Conditions.