ISO-Readyness ++

Keep a register of cloud services, with a data processing agreement for every tool, a designated owner and a documented exit plan, reviewed yearly. That is enough to comply.

In ClickUp, which the client already used, we built a self-service procurement flow in which every request automatically received a risk assessment, an onboarding checklist and contract templates. Only the CTO could approve a request. We mentored the team members and introduced a new rule in the information security policy, alongside an SOP: new infrastructure may only be introduced as IaC. We reduced the 11 SaaS tools to 6 and imported them into IaC. As a result, continuous control became automated, governed, documented and auditable.

The offboarding checklist must include a confidentiality reminder, signed return of equipment and a deadline for revoking access (for example 24 hours).

We used MS365 Entra ID as the centralized SCIM system and configured it as an external IdP in AWS, so access to laptops, MS365 licences, test and production systems and email could be controlled from one place. We documented the offboarding protocol and trained the IT leads. As a result, the permissions of 48 colleagues could be reduced, the number of admin-level accounts fell from 8 to 2, and for a new leaver access could be revoked within 5 minutes.

A ticket must be opened for every infrastructure change, with approval and a rollback plan recorded and production changes logged. If the team can show similar evidence for the last two or three changes, that is enough for certification...

We wrote IaC for the entire AWS infrastructure with Terraform, which GitHub Actions CI/CD deployed automatically to both test and production after code-review approval. Terraform detected drift automatically, which we also used actively for the migration, and faulty deployments could be reverted with a rollback commit, automatically and without human intervention. The process became fully automated, documented, controlled and audited. Deployments that used to happen every 2 months on average became daily.

A register of the data sources used by AI, with owner, classification and legal basis, updated yearly. The organization's current state meets the ISO requirements...

We assessed and documented how the data is produced and automated it with scripts, so datasets were produced daily. For training (and validating) the AI model we built a batch pipeline that runs weekly and, when the validation results are successful, deploys the resulting model. After several weeks of iterative training the model showed a significant F-score improvement (quality improved considerably), and the new process delivered controlled, verified robustness.

Describe the data quality requirements, clean the training data once and document the checks. Evidence of this is adequate for certification...

Based on the use case, the application area and the model, we defined and documented the data quality (and quantity) requirements up front. From the existing sources we exported the most extensive dataset, then normalized, cleaned, deduplicated and anonymized it, and coded this process so it is repeatable. The pipeline ran validation tests on the resulting data (freshness, duplicates, missing values, label checks, and quantity thresholds per vertical). After its very first successful run, the pipeline produced training data that increased the model's accuracy and coverage by 14% and 32%. After that, the pipeline and the training were re-run automatically every month.