- Version
- 2022
- Publisher
- ISO/IEC
- Last verified
- 2026-09-13
The established information-security management-system standard, with its control set in Annex A. It is in scope for AI deployments because most of what an AI system needs — access control, logging, cryptography, supplier management, incident response — is ordinary information security applied to a new kind of asset.
Certification is issued by an accredited body against the organisation's scoped management system, not against a deployment.
Annex A control text is copyrighted. Identifiers and our own descriptions only.
An AI deployment raises risks (training-data provenance, model theft, prompt injection) that ISO/IEC 27001 does not address directly — which is what ISO/IEC 42001 and CSA AICM are for.
What transfers unchanged
An inference endpoint is a service. The controls that secure a service secure it:
- Access control. Every caller of the model endpoint authenticates and is authorised. This sounds obvious and is the most frequently found real misconfiguration in self-hosted deployments — model servers commonly default to listening broadly, and an internal LLM on an open port is a data-exfiltration path with a chat interface attached.
- Network placement. The model server belongs behind a gateway on an internal interface, not bound to all interfaces because that was the quickstart command.
- Logging. Annex A's logging control applies exactly as to any other system, and the AI Act's record-keeping duty for high-risk systems sits on top of it.
- Cryptography and secure configuration. Standard practice, standard controls.
- Supplier relationships. Relevant whether you use a managed API or download weights from a model hub — in the second case the supplier question is about provenance and integrity of the artefact.
- Incident management. The procedure transfers; what counts as an incident does not, which is the next section.
The gaps, named rather than papered over
ISO/IEC 27001:2022 predates the deployment pattern this site is about, and three gaps are real:
Prompt injection has no Annex A control. Our mapping records this as a structural gap rather than mapping it to secure coding, which is the nearest neighbour and is not close. A retrieval system reads documents it does not control; those documents can contain instructions aimed at the model; the model has no reliable way to distinguish them from your instructions. That is an architectural property, not a coding defect, and the control is to constrain what the model is able to do rather than to filter what it reads. This is precisely the space ISO/IEC 42001 and CSA AICM exist to cover. An AI incident may involve no security failure. ISO/IEC 27001's incident controls trigger on security events. A system working exactly as built, with no compromise of any kind, can still produce a harmful output — a confidently wrong answer acted on, a biased ranking, a disclosure of something that was legitimately in the corpus but should not have surfaced to that reader. Your incident definition needs widening before your incident process is useful here. Data governance in Annex A is about protection, not representativeness. The controls ask whether data is classified, handled and protected appropriately. An AI deployment also has to ask whether the data is relevant and sufficiently representative for the people the system is used on — a question about fitness for purpose that the security standard does not pose.Recording these as gaps is deliberate. A mapping that forces prompt injection onto a secure-coding control tells a reader they are covered when they are not, which is worse than telling them nothing.
The self-hosting security trade
Running models yourself removes one class of risk and adds another, and an honest assessment counts both.
Removed: third-party data exposure in the inference path, dependency on a vendor's retention and change-control decisions, and the transfer analysis that comes with sending content to a processor in another jurisdiction. Added: you now operate an inference service, and it is yours to secure. The endpoint, the retrieval corpus, the model artefact and the GPU host are all assets someone must own. The corpus is the underrated one — a retrieval index frequently ends up containing material with broader access than the index itself, so the assistant becomes a query interface over documents its users could not otherwise open. Access control on the retrieval layer, not just on the endpoint, is the control that addresses it.Deployment controls that relate to ISO/IEC 27001
Annex A identifiers with our own descriptions. ISO's control text is copyrighted and sold; this repository stores identifiers and mapping metadata only. Note the structural gap recorded against prompt injection — it is a finding, not an omission.
AI risk management processCTL-RISK-0011 mapping▾
A documented, iterative process that identifies the risks this AI system poses to health, safety and fundamental rights, estimates them against the intended purpose and reasonably foreseeable misuse, and records the mitigations adopted. Reviewed on a schedule and after material change, not written once.
Clause 6.1.2Conceptual· medium confidenceInformation security risk assessment process
Conceptual only. ISO/IEC 27001's risk process concerns confidentiality, integrity and availability of information. An AI risk assessment under the AI Act concerns harm to people. The method transfers; the risk universe does not.
Last verified 2026-09-13Personal data handling in the inference pathCTL-PRIVACY-0011 mapping▾
Establish the lawful basis, the data minimisation position and the retention rule for personal data that enters prompts, retrieval context or logs. Inference logging is the common failure: a system designed not to store personal data often stores it anyway, in the log.
A.5.34Strong· high confidencePrivacy and protection of personally identifiable information
The Annex A control on PII protection covers identifying and meeting requirements for personal data within the management system. Strong: the same activity, different scope boundary.
Last verified 2026-09-13Inference and audit loggingCTL-LOGGING-0011 mapping▾
Record what the system was asked, what it answered, which model version answered, who was involved and when — to a retention period you chose deliberately. For high-risk systems the deployer must keep the automatically generated logs.
A.8.15Direct· high confidenceLogging of activities, exceptions and security events
The Annex A logging control is the same activity applied to information systems generally. An AI deployment is an information system.
Last verified 2026-09-13Access control and network isolation for the inference endpointCTL-SEC-0011 mapping▾
Authenticate and authorise every caller of the model endpoint, and place the endpoint where only intended callers can reach it. An internal model server on an open port is a data-exfiltration path with a chat interface.
A.5.15 / A.8.20Direct· high confidenceAccess control policy, and network security controls
Access control and network security are core Annex A controls and apply to an inference endpoint exactly as to any other service.
Last verified 2026-09-13Prompt injection and output handlingCTL-MODELSEC-0011 mapping▾
Treat model output as untrusted input to whatever consumes it. Where the model reads attacker-influenceable content — retrieved documents, user uploads, web pages — assume that content contains instructions aimed at the model, and constrain what the model is able to do about them.
A.8.28Structural gap· high confidenceSecure coding practices
Recorded as a STRUCTURAL GAP rather than a mapping. ISO/IEC 27001:2022 predates the prompt-injection class of attack and has no control addressing it. Secure coding is the nearest neighbour and it is not close. Naming the gap is more useful than forcing a mapping — this is exactly the case ISO/IEC 42001 and CSA AICM exist to cover.
Last verified 2026-09-13AI incident detection and responseCTL-INCIDENT-0011 mapping▾
A route for someone to report that the system did something wrong, a person who owns the response, and a record of what happened. For high-risk systems, serious incidents carry a reporting duty with a deadline.
A.5.24 / A.5.25Strong· high confidenceIncident management planning and preparation, and assessment of security events
The incident management controls transfer, but their trigger is a security event. An AI incident may involve no security failure at all — a system that is working exactly as built can still produce a harmful result, which is the gap this control widens.
Last verified 2026-09-13Assess a specific deployment
The generic answer is on this page. The specific one depends on what your system is for, who it affects and what it decides — which is what the assessment asks about.
Automated assessment based on the information you provide. Not legal advice, certification or an audit.
Frequently asked questions
We are ISO/IEC 27001 certified. Does our AI deployment inherit that?
Only if it is inside the certified scope, and scope is the question to check first — an ISMS scoped to a production platform may not cover a GPU workstation someone put under a desk. Beyond scope, certification covers the security controls; it says nothing about whether the system is classified correctly under the EU AI Act, whether its data is representative, or whether its outputs are overseen.
Which ISO/IEC 27001 controls matter most for a self-hosted LLM?
Access control and network security, because the most common real failure is an unauthenticated model endpoint reachable more broadly than intended. Then logging, because it is the evidence every other control cites. Then supplier relationships applied to the model artefact — where the weights came from and whether the file you are running is the file you intended to run.
Does ISO/IEC 27001 cover prompt injection?
No, and our mapping says so explicitly rather than stretching secure coding to fit. The 2022 control set predates the attack class, and prompt injection is an architectural property of systems that put untrusted text and trusted instructions in the same context window, not a coding defect. CSA AICM and ISO/IEC 42001 are the frameworks in this set that address AI-specific attack surface.