---
title: "ISO 42001 Gap Analysis & Risk Assessment Methodology"
description: "Learn how to run an ISO 42001 gap analysis and AI risk assessment together, avoid duplicated work, and build an efficient compliance process."
canonical: "https://axipro.co/iso-42001-gap-analysis-and-risk-assessment/"
language: "en-US"
modified: "2026-09-09T07:37:08+00:00"
generator: "WordPress 7.1.2"
---

[Home](https://axipro.co)

/ [ISO 42001](https://axipro.co/category/iso-42001/)

/ ISO 42001 Gap Analysis and Risk Assessment Methodology

# ISO 42001 Gap Analysis and Risk Assessment Methodology

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

- Pedro Dias
- September 9, 2026

Copy Link

[ISO/IEC 42001:2023](https://axipro.co/iso-42001/) asks for three assessments, and most teams try to squeeze them into one spreadsheet: a gap analysis against clauses 4 to 10 and Annex A, an AI risk assessment under clause 6.1.2, and an AI system impact assessment under clause 6.1.4.

Treat them as one exercise and the auditor pulls them apart for you at Stage 2. Treat them as three unrelated projects and you triple the workshops, the registers, and the remediation lists. What works is **a single methodology with distinct outputs** that share inputs, share a traceability matrix, and feed one remediation plan.

This article lays out that methodology end to end: how gap analysis and risk assessment fit together under ISO 42001, how to prepare, the step-by-step process for each, how to merge the outputs into one risk treatment plan, the registers and templates you’ll need, and what a certification body expects to see when you’re done.

## **Why Gap Analysis and Risk Assessment Must Work Together Under ISO 42001**

A gap analysis measures distance from the standard. A risk assessment measures exposure from your AI systems. They answer different questions, and ISO 42001 makes them depend on each other in a way [ISO 27001](https://en.wikipedia.org/wiki/ISO/IEC_27001) only implies.

Clause 6.1.3 requires you to compare the controls you select through risk treatment against Annex A, and to justify any Annex A control you leave out in the Statement of Applicability (SoA). So your **Annex A gap analysis has no defensible baseline until the risk assessment tells you which controls you need**. Run the gap analysis on its own, and you end up scoring yourself against all 38 controls, including ones your risk profile never called for. Run the risk assessment on its own, and you pick treatments with no idea what already exists to deliver them. The methodology below interleaves the two. A clause-level gap review sets the scope and evidence base, the risk and impact assessments decide which controls are required, and a control-level gap review then scores only what matters.

### How AI-specific risks shape the methodology

Traditional information security risk works from confidentiality, integrity, and availability. AI risk adds categories that don’t map neatly onto any of those: **model drift, bias in training data, outputs nobody can explain, automation bias in the humans doing the reviewing, and dependence on third-party foundation models** whose behavior changes without warning. [ISO/IEC 23894](https://www.iso.org/standard/77304.html), the companion guidance on AI risk management, adapts the [ISO 31000](https://en.wikipedia.org/wiki/ISO_31000) cycle (establish context, identify, analyze, evaluate, treat) to these sources rather than inventing a new one. That’s why the methodology here keeps the familiar ISO 31000 shape and changes the inputs, not the process.

### Regulatory and business drivers for a formal methodology

The commercial driver is procurement. Enterprise security questionnaires now ask whether you ran an AI impact assessment, whether a human reviews high-stakes outputs, and which third-party models touch customer data. A documented methodology answers those questions with evidence instead of assurances.

The regulatory driver is the [EU AI Act](https://axipro.co/eu-ai-act-compliance-and-certification/), and its timeline moved in July. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on July 27, 2026, and pushed the high-risk obligations for standalone Annex III systems from August 2, 2026 to December 2, 2027. Annex I embedded systems moved to August 2, 2028. The [Article 50 transparency obligations](https://axipro.co/eu-ai-act-article-50/) still kicked in on August 2, 2026, as originally planned. Article 9 of the [AI Act text on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689) requires a risk management system for high-risk AI that runs continuously across the system lifecycle, which is exactly what an ISO 42001 methodology gives you. **Sixteen extra months is time to build it properly, not a reason to shelve it.**

## **Core Principles of an ISO 42001 Gap Analysis and Risk Assessment Methodology**

Four principles keep the methodology defensible in front of a certification body.

1. **Alignment with clauses 4 to 10 and Annex A.**
Every finding in the gap register cites a clause or an Annex A control identifier. Auditors work clause by clause, so a gap register organized any other way forces a translation step during the audit that nobody enjoys.
2. **Integration with the AI system impact assessment.** Clause 6.1.4 is what separates ISO 42001 from every other Annex SL standard. The impact assessment looks *outward* at individuals, groups, and society. The risk assessment under 6.1.2 looks *inward* at the organization. The standard wants both as separate documented outputs, and the consequences you find in the impact assessment have to feed back into the risk assessment. So the methodology runs the impact assessment as a scheduled input to risk analysis, not something bolted on the week before the audit.
3. **Risk-based thinking applied to the AIMS itself.** Clause 6.1.1 also asks you to consider risks and opportunities to the management system: someone leaving the AI governance function, a vendor retiring a model, a regulator changing its classification rules. These go in the same register with a different category tag.
4. **Defined inputs, outputs, and success criteria.** Inputs are the AI system inventory, the scope statement, existing policies, data flow diagrams, model documentation, and your risk criteria. Outputs are the gap register, the AI risk register, impact assessment reports, the SoA, and the risk treatment plan. Success means each output traces to the others, every gap and risk has an owner, and an internal auditor could repeat the process and land somewhere similar.

**Insider Note:** Impact assessments are where certification auditors probe hardest, because they’re the most distinctive part of ISO 42001 compared with ISO 27001. A recycled security risk register with “AI” pasted into the risk titles gets picked apart in Stage 2. Build the impact assessment methodology properly the first time. It’s far cheaper than rebuilding it under a nonconformity deadline.

Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.

Schedule Your Free Assessment Today

[Schedule a consultation](https://axipro.co/free-assessment/)

## **Preparing for the Gap Analysis and Risk Assessment**

Preparation is where most of the calendar time goes, and where most later problems start.

- **Define scope, boundaries, and the AI system inventory.**
Scope under clause 4.3 has to name which AI systems, business units, and lifecycle stages the AIMS covers. You can’t write that statement without an inventory, and the inventory is the step teams skip most often. Include [shadow AI](https://axipro.co/shadow-ai-policy-template/): SaaS products that added AI features, agents running under employee credentials, internal scripts calling model APIs. For each system, record its purpose, the role you play (developer, provider, deployer, or user), the data it consumes, its outputs, and whether a human sits between the output and the decision.
- **Identify roles.**
ISO 42001 distinguishes AI actors across the value chain. Your methodology needs a risk owner for each AI system, an assessor who doesn’t sit on that system’s development team, and a governance body that accepts residual risk. In a 40-person company, these can be three people. They can’t be one person.
- **Gather evidence.**
Policies, data flow diagrams, model cards or whatever documentation you have, training-data provenance records, vendor contracts for third-party models, incident logs, and any existing risk assessments from ISO 27001 or privacy work. Missing evidence is itself a gap finding, so record the absence rather than waiting for someone to produce it.
- **Select assessment criteria and maturity scales.**
Pick a [maturity scale](https://axipro.co/ai-governance-maturity-model/) before you score anything, and write down what each level means in terms someone could observe. A five-level scale (not performed, ad hoc, defined, managed, optimized) works for most organizations. For risk, define likelihood and severity scales with anchored descriptions, plus a risk acceptance threshold that management has signed off. This is the AI risk criteria document the standard requires under 6.1.2, and it has to exist before the first risk workshop.

### Pro Tip: Make Risk Likelihood Testable

Write the likelihood scale in terms of model behavior, not just events. *"Occurs in more than 1% of inferences"* is a testable likelihood for an output quality risk. *"Possible"* isn't. Anchored scales also turn reassessment after a retrain into a measurement exercise instead of an argument.

## **Step-by-Step Gap Analysis Methodology**

### Step 1: Map current AIMS state to ISO 42001 requirements

Build a requirements matrix with one row per “shall” statement in clauses 4 through 10. Against each, record what exists today, where the evidence lives, and who owns it. If you’re already certified to ISO 27001, roughly **half the clause requirements have an existing counterpart**: document control, competence records, internal audit, management review, and corrective action all follow the same Annex SL pattern. Map them. Don’t rebuild them.

### Step 2: Clause-by-clause conformity review

Score each requirement on your maturity scale using three evidence types:

- **documented** (does a policy or procedure exist),
- **implemented** (does anyone follow it), and
- **effective** (does it produce the intended result). A policy that exists but nobody follows scores as ad hoc, not defined. Interview the people doing the work, not just the people who wrote the documents.

### Step 3: Annex A control applicability analysis

Sequencing matters here. Do a first pass that records, for all 38 controls across the nine objective groups, whether the control is currently in place and what evidence supports it. **Don’t decide applicability yet.** That happens after the risk assessment, in Step 5 of the risk methodology, once you know which controls your treatments call for. Recording current state now saves you a second round of evidence collection later.

### Step 4: Gap identification, categorization, and scoring

Categorize each gap by type: missing documentation, missing implementation, ineffective implementation, or missing evidence. Score criticality on a scale that reflects what it means for certification, not how much effort it takes to fix. A missing AI policy under clause 5.2 is a major nonconformity waiting to happen. An incomplete competence matrix is a minor. Effort estimates belong in the remediation plan, not the gap score.

### Step 5: Root cause analysis for identified gaps

Twenty gaps usually share about three root causes. No AI system inventory explains missing scope, missing impact assessments, and missing supplier controls all at once. No assigned governance role explains stale policies, thin management review inputs, and unowned risks. **Fix the root causes and the individual gaps close on their own.**

## **Step-by-Step AI Risk Assessment Methodology**

### Step 1: Identify AI-specific risk sources and threats

Run identification per AI system, not per organization. ISO/IEC 23894 structures it around AI-related objectives (fairness, safety, security, transparency, accountability, privacy, robustness) and risk sources (data quality, model complexity, automation level, environmental change, and how much human oversight there is). Work the intersection: for each objective, which sources in this system threaten it? For generative systems, [NIST’s Generative AI Profile (NIST AI 600-1)](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf) catalogs risks that are new to or made worse by generative models, including confabulation, harmful content, and information integrity. It’s a good completeness check.

### Step 2: Analyze risks to individuals, groups, and society

This is where the impact assessment plugs in. For each system, it documents intended use, foreseeable misuse, who’s affected, and the potential harms and benefits to individuals, groups, and society, including effects on rights, autonomy, and safety. [ISO/IEC 42005:2025](https://www.iso.org/standard/44545.html) gives you a structured method and a harm taxonomy for this. The consequences from the impact assessment then become the severity inputs for the organizational risk analysis. **The two documents stay separate. The traceability between them is what the auditor checks.**

### Step 3: Evaluate likelihood, severity, and AI system impact

Apply the anchored scales from the preparation stage. Score likelihood and severity for the organization and record the impact assessment reference for the external dimension. Compare each result against your acceptance threshold. Anything above it moves to treatment. Anything below it gets documented as accepted, with the acceptor’s name and date.

### Step 4: Determine risk treatment options and controls

Four options: modify (reduce likelihood or severity), retain, avoid, or share. For each risk above threshold, pick an option and identify the controls that deliver it. **Human oversight mechanisms, data quality checks, model monitoring, transparency notices, and supplier due diligence** are the treatments that show up most often in AI risk registers.

### Step 5: Link risks to Annex A controls and the Statement of Applicability

Map every selected control to an Annex A identifier, or record it as an additional control if Annex A has no equivalent. Then finish the applicability pass you deferred during the gap analysis. Any Annex A control that no risk treatment needs and no legal or contractual obligation requires gets excluded with a written justification. Any control that is needed gets marked applicable, and its current state from the gap analysis tells you how far you are from having it work. **The SoA comes out of this step, and it’s the document that ties the two halves of the methodology together.**

## **Combining Gap and Risk Outputs into a Unified Remediation Plan**

### Prioritization matrix: risk severity vs. gap criticality

Plot each applicable control on two axes: the highest-rated risk it treats, and how big the gap is between current and required state. High risk plus large gap gets scheduled first. High risk plus small gap is your quick wins for early momentum. Low risk plus large gap goes last, and if the calendar is tight, it’s a candidate for cutting from scope.

### Building the risk treatment plan

The risk treatment plan under 6.1.3 lists each risk, its treatment option, the controls selected, who’s responsible, the target date, and how you’ll measure whether it worked. Management approves it, and that approval is evidence the auditor will ask for. Reference the gap register entries; the plan closes so nobody ends up maintaining two lists.

### Assigning owners, timelines, and resources

Owners are named individuals rather than teams. Timelines have to leave room for the AIMS to run before the audit, because **Stage 2 wants proof the controls operated, not just that you designed them**. For most organizations that means the treatment plan wraps up at least two to three months before the Stage 2 date. Axipro’s breakdown of [how long ISO 42001 certification takes](https://axipro.co/iso-42001-certification-timeline/) explains why that operating window, not the documentation, is usually the longest item on the calendar.

### Documenting residual risk and acceptance

After treatment, rescore. The residual risk, the acceptor, and the acceptance date go on the register. Residual risk still above threshold needs either more treatment or a management-level acceptance with a written rationale. **An empty residual risk column is one of the most common minor nonconformities in first-time ISO 42001 audits.**

**Important:** Don’t let the risk treatment plan swallow the gap register. They overlap a lot, but they aren’t identical. Some gaps (an incomplete competence matrix, a missing management review agenda item) are conformity gaps with no matching AI risk, and they still have to be closed before certification. Keep both lists and cross-reference them.

## **Methodology Tools, Templates, and Artifacts**

The methodology produces four artifacts, and how you structure them decides whether the audit is a review or an excavation.

**Gap analysis register.** One row per requirement or control, with fields for identifier, requirement summary, current state, maturity score, evidence reference, gap type, criticality, root cause, remediation reference, owner, and status.

**AI risk register.** One row per risk, with fields for risk ID, AI system, risk source, affected objective, description, impact assessment reference, likelihood, severity, inherent risk, treatment option, controls (Annex A identifiers), owner, target date, residual likelihood, residual severity, residual risk, acceptor, and review date.

**Impact assessment template.** Per AI system: system description and intended purpose, AI actors and roles, data used, affected individuals and groups, foreseeable misuse, potential harms by category (rights, safety, autonomy, fairness, environmental, societal), potential benefits, existing safeguards, assessment result, and review triggers.

**Traceability matrix.** Risk ID to control ID to gap ID to remediation action to evidence location. This one sheet lets an auditor pick any risk and follow it to a working control in under a minute, which is exactly the experience you want them to have.

A GRC platform can hold all four and automate the evidence links, and most ISO 42001 programs run on one. **A person still has to design the methodology. The platform only enforces it.**

Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.

Schedule Your Free Assessment Today

[Schedule a consultation](https://axipro.co/free-assessment/)

## Common Pitfalls and Best Practices

- **Overlap between security, privacy, and AI risk registers.**
Organizations with ISO 27001 and a privacy program end up with three registers that all say “training data contains personal information.” Either keep one enterprise register with a framework tag per risk, or keep separate registers with explicit cross-references. Both work. Three uncoordinated registers on different scales don’t, and auditors notice when the same risk carries three different scores.
- **Objectivity and repeatability.**
Two assessors scoring the same system should land within one level of each other. Anchored scales, documented evidence requirements per maturity level, and assessors who are independent of the development team get you there. Calibrate by having two people score one system on their own before the full assessment.
- **Continuous reassessment cycles.**
A risk register scored at launch is stale after the first retrain. Define review triggers: model retraining, new data sources, a change in deployment context, a vendor model update, a reported incident, or a regulatory change. Add a fixed annual review as the backstop. Article 9 of the AI Act and clause 8.2 of ISO 42001 both expect reassessment to be systematic rather than reactive.
- **Alignment with EU AI Act, NIST AI RMF, and ISO 27001.**
Build the methodology once and tag the outputs for each framework. The [NIST AI RMF Core](https://axipro.co/nist-ai-rmf-1-0/) functions map closely: Map covers inventory and identification, Measure covers analysis and evaluation, Manage covers treatment, and Govern sits across all of it. EU AI Act Article 9 risk management and the Annex III classification checks slot into the impact assessment. [ISO/IEC 27005](https://www.iso.org/standard/80585.html) risk methods carry over almost untouched for the security subset of AI risks. The [ISO catalog of AI standards](https://www.iso.org/committee/6794475.html) shows how 42001, 23894, 42005, and 42006 relate, and mapping to them once saves every audit after that.

### Worth Knowing: The AI system inventory

The AI system inventory is the single input that derails first-time programs most often. Teams write the AI policy, then find out during impact assessment that a sales tool, a support chatbot, and a hiring screener nobody flagged are all in scope. Every downstream document gets rewritten. Run inventory discovery as its own two-week sprint before any workshop.

## **Validating and Maintaining the Methodology**

**Internal audit of the gap and risk process.** Clause 9.2 requires internal audit of the AIMS, and the risk methodology is part of the AIMS. The internal auditor checks that the risk criteria were approved before assessment started, that the scales were applied consistently, that an impact assessment exists for every in-scope system, and that the SoA justifications hold up. Sample the traceability matrix end to end.

**Management review inputs.** Clause 9.3 requires management review to look at risk assessment results and the status of the treatment plan. Give it a summary: risks above threshold, overdue treatments, residual risks accepted since the last review, and any change to the risk criteria. The minutes are audit evidence.

**Continuous improvement.** Every reassessment cycle should log at least one change to the methodology itself: a scale that needed sharpening, a risk source that was missing, a template field nobody used. That log is how you show the [Plan-Do-Check-Act loop](https://en.wikipedia.org/wiki/PDCA) the standard is built on, and it’s the difference between a methodology that gets followed and one that gets filed.

If you’re deciding whether to run this in-house or with help, Axipro’s [ISO 42001 gap analysis](https://axipro.co/services/gap-analysis/) engagement produces the clause-level and control-level gap registers and a remediation roadmap in one to three weeks. The full [ISO 42001 certification](https://axipro.co/iso-42001-certification/) program carries the risk methodology, impact assessments, SoA, and treatment plan through to guaranteed certification on the Achievement Plan. The comparison of [gap analysis versus full implementation support](https://axipro.co/iso-42001-gap-analysis-vs-full-implementation-support/) covers which model fits which starting point.

A defensible ISO 42001 methodology is one process with three outputs: **a gap register that measures distance from the standard, an AI risk register that measures your exposure, and impact assessments that measure consequences for people.** The risk assessment decides which Annex A controls apply, the gap analysis measures how far each one is from working, and the SoA and treatment plan tie the two together. Get the inventory and the risk criteria right before the first workshop, keep the registers cross-referenced, and reassess on triggers rather than on the calendar. That’s what a certification body is looking for, and it’s what an enterprise buyer’s AI questionnaire is really asking.

## Frequently Asked Questions

How is ISO 42001 risk assessment different from ISO 27001 risk assessment?

ISO 27001 risk assessment centers on threats to the confidentiality, integrity, and availability of information. ISO 42001 keeps that ISO 31000 process shape but adds AI-specific risk sources like bias, drift, explainability, and automation level, and it requires a separate AI system impact assessment that looks at consequences for individuals and society rather than the organization. You can extend an ISO 27001 register to cover the security subset of AI risks, but it can’t stand in for the impact assessment.

Should gap analysis be performed before or after the AI risk assessment?

Both, in sequence. Run the clause-level gap review and the Annex A current-state pass first, because they build the evidence base and scope. Then run the risk and impact assessments, which decide which Annex A controls apply. Finish with control-level gap scoring against only the applicable controls, which gives you the SoA and the remediation plan.

How often should the gap analysis and risk assessment be repeated?

Reassess risk on defined triggers (model retraining, new data sources, deployment changes, vendor model updates, incidents, regulatory changes) with an annual review as the floor. Repeat the gap analysis before each surveillance audit and after any significant change to AIMS scope. A methodology that only reassesses annually will be out of date within months for any AI system under active development.

Can the methodology be automated or supported by tools?

The registers, evidence links, and review reminders can run in a GRC platform, and most ISO 42001 programs do that. The judgment steps can’t: defining risk criteria, running impact assessment workshops, choosing treatment options, and justifying SoA exclusions need a person who knows the systems and the standard. Automation removes the spreadsheet work. It doesn’t remove the assessor.

What deliverables should the methodology produce for certification?

At minimum: the approved AI risk criteria, the AI system inventory, the gap analysis register, the AI risk register, an impact assessment report for each in-scope system, the Statement of Applicability with justified exclusions, the management-approved risk treatment plan with residual risk acceptance, and evidence that the process was internally audited and reviewed by management. Certification bodies working under ISO/IEC 42006 will ask for each of these by name.

Axipro Author

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

### Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

- September 9, 2026
- [ISO 42001](https://axipro.co/category/iso-42001/)

Copy Link

## Blog Highlights

## Explore More Articles

[Read More Blogs](https://axipro.co/blog/)

- [Vanta](https://axipro.co/category/vanta/)

- October 3, 2026

#### [Best Vanta Deployment Service (2026): 7 Partners Ranked](https://axipro.co/best-vanta-deployment-service/)

Vanta can tell you a control is failing within the hour. It cannot rewrite your access review process, decide which systems belong in audit scope, or explain to a CPA why a test that shows red is actually fine. That work falls to people, and choosing the right ones is the difference between a 6-week path to audit readiness and a 6-month slog that ends with your Vanta subscription renewing before you have a report. This guide ranks the 7 best Vanta deployment services for 2026, explains what each one is good at, and covers what most comparison pages skip: how long this really takes, what it costs, and how to spot a partner who’ll hand you a half-configured platform and disappear. What Is a Vanta Deployment Service? A Vanta deployment service is a hands-on engagement where a specialist firm sets up, configures, and operationalizes Vanta so your company reaches audit readiness for one or more compliance frameworks. Vanta itself is a compliance automation and trust management platform: it connects to your cloud, identity provider, code repositories, HR system, and endpoints, then runs automated tests and maps the evidence to frameworks such as SOC 2, ISO 27001, HIPAA, and GDPR. The platform automates evidence collection and continuous monitoring. It doesn’t put controls in place for you. A deployment partner handles the judgment work around the tool: scoping, gap analysis, control mapping, policy writing, risk assessment, remediation of failing tests, and coordination with the audit firm. The best partners also stay on after the audit, because a Vanta instance nobody owns degrades fast. Worth Knowing: Vanta is a software vendor, not an auditor. Vanta is a software vendor, not an auditor. Your SOC 2 report still comes from a licensed CPA firm under AICPA attestation standards, and your ISO 27001 certificate comes from an accredited certification body. A deployment partner sits between the platform and the auditor. 1. Axipro Best for: SaaS and technology companies that want Vanta deployed, controls implemented, and the audit delivered by one accountable team, fast. Axipro is an authorized Vanta partner and a Drata Elite Partner, so its team works inside both leading compliance automation platforms every day. Founded in 2023, it has served 200+ clients from offices in the US, UK, and Bahrain, with a 100% audit success rate across 200+ certified clients. What puts Axipro first is scope. Most Vanta partners configure the platform and leave control implementation to you. Axipro’s Achievement Plan covers the whole path: kick-off and Vanta setup, gap analysis, a full policy and procedure suite, risk assessment and treatment, control implementation, vulnerability scanning, an internal audit, and external audit facilitation with an independent auditor. Clients get a dedicated infosec team over Slack, and the Achievement Plan comes with guaranteed certification. The other reason is speed. Axipro typically reaches SOC 2 readiness in around four weeks and ISO 27001 certification readiness in as little as six. It supports 20+ frameworks, including SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, CMMC, ISO 42001, and the EU AI Act, plus Gulf frameworks such as NCA ECC and SAMA CSF that most US-only partners cannot cover. Teams that want to test the relationship first can start with the free 30-day Compliance Accelerator Plan, which includes Vanta setup, gap analysis, and policy documentation, and continue into ongoing vCISO and continuous monitoring through the Trust Assurance Plan after certification. Watch for: Axipro is built for companies that want the work done for them. Teams that want a light-touch coaching engagement and plan to run the program in-house will use only part of what it offers. 2. Control and Function Best for: US SaaS companies of roughly 10 to 60 people that want SOC 2 and ISO 27001 run as one fixed-price project. Control and Function is a Denver-based consultancy built around fixed-scope, fixed-price readiness for small SaaS teams that have no compliance department. Its sweet spot is the dual-framework engagement: building SOC 2 and ISO 27001 from one shared control set rather than running two projects back to back. It also covers HIPAA for healthtech and maps ed-tech requirements such as FERPA and HECVAT. The firm is platform-neutral, so it works inside Vanta rather than reselling it, and it is explicit about handing off cleanly to an independent auditor. It’s also one of the few firms here that publishes prices, with readiness coaching starting around $8,000 and full readiness around $15,000. Watch for: The framework range is narrower than larger partners. Companies that need PCI DSS, CMMC, or international frameworks will need a second provider. 3. Neutral Partners Best for: Growing companies that need managed GRC across SOC 2, ISO 27001, CMMC, and FedRAMP without hiring an internal compliance team. Neutral Partners, based in Miami, runs a managed GRC model. It builds and documents the compliance program, tests it through internal audits, and then hands off to the relevant independent assessor: a CPA firm for SOC 2, a certification body for ISO 27001, or a C3PAO for CMMC. It never issues the certificate itself, which keeps the independence question simple. Its framework coverage leans toward regulated and government-adjacent work, including CMMC, FedRAMP, PCI DSS, HIPAA, and HITRUST. That makes it worth a look for defense suppliers and companies selling to the public sector. Watch for: Vanta isn’t its main focus. Ask for recent Vanta deployment examples in your framework before signing. 4. Kobalt.io Best for: Small and mid-sized businesses that want Vanta plus managed security operations. Canada-based Kobalt.io markets itself as one of Vanta’s leading global service partners. Its Vanta practice covers policy and control development inside the platform, custom control mapping where standard controls do not fit, and an applicability review of Vanta’s tests. The broader appeal is its managed security services, which suit companies that want compliance and security operations from the same provider. 5. AuditPeak Best for: Startups that want a readiness and audit-preparation partner focused narrowly on SOC 2. AuditPeak focuses on SOC 2 audit readiness for early-stage companies working in

[Read more](https://axipro.co/best-vanta-deployment-service/)

- [ISO-27001](https://axipro.co/category/iso-27001-2/)

- September 29, 2026

#### [ISO 27001 Consultant vs. Software: Which Is Faster?](https://axipro.co/iso-27001-consultant-vs-software/)

Compliance software collects the evidence. A consultant builds the system that evidence is meant to prove. That’s the real difference in the ISO 27001 consultant vs software decision, and most teams only figure it out after they’ve bought one and realized they still need the other. Below, we compare what each route covers, where it breaks down, and what it costs you in time, money, and your team’s hours. Short version: software on its own works for a small group of companies. For most SaaS and tech scale-ups trying to get an enterprise deal over the line, consultant-led implementation on a compliance platform is the faster and safer path to a certificate. Quick Answer: Consultant, Software, or Both? Software-only works if you already have an in-house security lead who’s taken a company through ISO/IEC 27001 before and has the time to own the project. Consultant-only still makes sense if you run mostly on-premise or legacy systems that platforms barely integrate with. For everyone else, which means most cloud-native companies under a few hundred people, a hybrid works best: a platform to handle evidence and monitoring, and a consultant to build the management system and stand behind it in front of an auditor. Here’s why. What an ISO 27001 Consultant Handles ISO/IEC 27001:2022 is a management system standard. Clauses 4 to 10 cover how you run information security, and Annex A lists 93 controls you pick from based on risk. Almost none of it is box-ticking. Most of it comes down to judgment calls about your business, and that’s what you’re paying a consultant for. Scoping, Gap Analysis and Risk Assessment Scope is the first decision you make, and the most expensive one to get wrong. Go too wide and you’ll spend months on controls for systems no customer asks about. Go too narrow and the certificate won’t get through the procurement review it was supposed to pass. A consultant scopes around the deals you’re trying to close, runs a gap analysis, and builds a risk assessment based on your real assets and threats. That’s the document auditors dig into hardest. ISMS Documentation and Policy Writing The standard asks for a specific set of documents: the ISMS scope, information security policy, risk assessment and treatment methodology, Statement of Applicability, risk treatment plan, and evidence of competence, monitoring, internal audit, and management review. A consultant writes these around how your company works day to day, instead of how a template imagines it works. Auditors check whether you follow your own procedures, so a mismatch shows up fast. Internal Audit and Certification Audit Support You need an internal audit before certification, and Clause 9.2 says the auditor has to be objective and impartial. In a small company, the people who built the ISMS can’t credibly audit it, so most teams outsource it through ISO 27001 internal audit services. A good consultant also gets your team ready for the Stage 1 and Stage 2 audits, joins the conversations that matter, and handles corrective actions if the auditor raises nonconformities. What ISO 27001 Compliance Software Handles Compliance automation platforms, often called GRC platforms, have changed how cloud-native companies get certified. They’re very good at the repetitive, evidence-heavy side of the work. Automated Evidence Collection and Continuous Control Monitoring The platform plugs into your cloud provider, identity provider, code repos, HR system, and device management tools, then pulls evidence on its own. It’ll flag an unencrypted storage bucket, an ex-employee who still has access, or a laptop without disk encryption. For technical controls, that saves weeks of screenshots and spreadsheet tracking. Policy Templates and Annex A Control Mapping Most platforms come with a policy library and map each control to the ISO 27001 clauses and Annex A. You get a starting point and a clear view of which controls have evidence and which don’t. Auditor Access and Ongoing Compliance Tracking Auditors can log in and review evidence themselves, which cuts down fieldwork. After you’re certified, dashboards show when controls slip between surveillance audits, so you aren’t rebuilding evidence from scratch every year. Where Each Approach Falls Short Neither route covers everything by itself. The good news is that the ways each one fails are predictable, so you can plan around them. Limits of Compliance Automation Platforms A platform can tell you a control is failing. It can’t decide your scope, run your risk assessment, write a policy that matches your operations, convince your CTO to change the offboarding process, or explain to an auditor why you excluded a control from your Statement of Applicability. Templates can also make you feel further along than you are. A dashboard at 90% can hide an ISMS that won’t survive Stage 1, because the missing 10% is the management system itself. Insider Note: The Stage 1 problem we see most on software-only projects is a risk assessment copied straight from the platform’s default risk library. The risks are generic, the scores are almost identical, and nothing ties back to the company’s own assets. Auditors notice within minutes, and it weakens the Statement of Applicability that’s built on it. The other problem is ownership. Software assumes someone inside the company will drive the project. At most startups that’s a CTO or ops lead who already has a full-time job, and the subscription renews whether the work gets done or not. Limits of a Consultant-Only Approach A consultant working without automation spends billable days on things a platform does for free, like chasing screenshots, updating evidence trackers, and collecting the same proof again before every surveillance audit. You pay more and wait longer. You also end up with a program that’s only accurate on the day it’s handed over. Once the engagement ends, the evidence goes stale and year-two surveillance turns into a scramble. ISO 27001 Consultant vs Software: Side-by-Side Comparison Factor Consultant only Software only Hybrid (consultant + platform) Time to audit readiness 3 to 6+ months Highly variable; depends on internal expertise As little as 6 weeks for well-scoped

[Read more](https://axipro.co/iso-27001-consultant-vs-software/)

- [AI Security](https://axipro.co/category/ai-security/)

- September 27, 2026

#### [Uzbekistan AI Regulation 2026: Law ZRU-1115 Explained](https://axipro.co/uzbekistan-ai-regulation/)

Uzbekistan regulates artificial intelligence through two documents. The first is Law ZRU-1115, signed on 21 January 2026. It amends existing legislation to define AI, stops anyone from basing decisions about people’s rights on AI output alone, and fines companies that process personal data unlawfully with AI. The second is the set of Ethical Rules approved by Order No. 3787, in force since 17 June 2026, which spell out what developers, implementers, and users actually have to do. Uzbekistan hasn’t passed a standalone AI act, and its rules don’t sort systems into risk tiers or require conformity assessments. The framework is short and blunt, and it’s already enforceable. Below we walk through what each document requires, who it applies to, how it stacks up against the EU AI Act, and what a company using AI in Uzbekistan should do next. Uzbekistan AI Regulation at a Glance (TL;DR) Instrument Date What it does Who it binds Law ZRU-1115 Signed 21 January 2026 Defines AI in law, sets general rules for AI-built information resources and systems, bans legally significant decisions based only on AI, adds fines for unlawful AI processing of personal data State bodies, organizations, website owners, anyone processing personal data with AI Order No. 3787 (Ethical Rules) Registered 14 March 2026, in force 17 June 2026 Sets eight mandatory ethical principles and lists rights and obligations for developers, implementers, and users Individuals and companies developing, implementing, or using AI in Uzbekistan Law No. 1125 (Personal Data amendments) Adopted 26 March 2026 Limits data localization to biometric, genetic, and local telecom user data, and allows cross-border transfers under conditions Personal data operators, including AI providers AI Strategy until 2030 (RP-358) 14 October 2024 Sets national targets for AI adoption, infrastructure, and skills Government bodies What Is Law ZRU-1115? The law’s official title is a mouthful: “On making additions and changes to certain legislative acts of the Republic of Uzbekistan in connection with the regulation of relations arising from the use of artificial intelligence.” Put simply, it’s an amending law. Instead of creating a new AI code, it writes AI into laws that were already on the books. When It Was Signed and When It Took Effect The Legislative Chamber of the Oliy Majlis adopted the bill on 12 August 2025, and the Senate approved it on 1 November 2025. President Shavkat Mirziyoyev signed it on 21 January 2026. You can read the official text in Lex.uz, Uzbekistan’s national legislation database. The law set out the principles and the penalties. The day-to-day detail arrived later with the Ethical Rules, which came into force on 17 June 2026. For compliance planning, treat mid-June 2026 as the point when the whole framework started applying. Why Uzbekistan Amended Existing Laws Instead of Passing a Standalone AI Act Uzbekistan wants more AI, not less. Its national strategy sets numeric targets for adoption, investment, and local computing capacity, and a heavy EU-style act would have worked against them. So lawmakers kept it light. They defined AI, drew two hard lines (human control over decisions that affect people’s rights, and protection of personal data), and left the Ministry of Digital Technologies to fill in the rest through secondary rules. Businesses get less legal certainty, and the government gets to move faster. Which Laws ZRU-1115 Changes For businesses, two amendments matter most. The Law “On Informatization” (ZRU-560-II, 2003) now contains a legal definition of AI, a new article on using AI in information resources and systems, duties for website owners, and updated powers for the ministry in charge. The Code on Administrative Liability now includes an offense for processing and spreading personal data unlawfully using AI. The Legal Definition of Artificial Intelligence in Uzbekistan Under the amended Law “On Informatization,” AI is a set of technological solutions that imitate human cognitive functions, including learning on their own and solving problems, and that produce results on specific tasks comparable to what a person could do. That’s deliberately broad. It covers generative AI, machine learning classifiers, recommendation engines, and most agentic systems. The Ethical Rules add a narrower term, the AI system: software built on AI that can find, collect, store, analyze, process, evaluate, and use data, and make decisions on its own based on that data. If your product makes a decision from data, or shapes one, assume it counts. Key Rules Introduced by Law ZRU-1115 General Principles for Using AI in Information Systems and Resources The new article in the Law “On Informatization” starts from harm. Information resources created with AI, and information systems running on AI, must not harm people’s life, health, freedom, honor, or dignity, or violate their other inalienable rights. The standard is short and open-ended. It gives regulators something to enforce against without saying in advance what counts as harm. Principle-based rules like this deserve to be taken seriously precisely because the edges are undefined. Human Oversight: No Decisions on Rights and Freedoms Based Solely on AI Most coverage leads with this provision, and it’s easy to see why. When someone makes a legally significant decision that affects human rights and freedoms, they can’t rely only on conclusions produced by AI systems or AI-built information resources. AI can feed into the decision, but a person has to make it. That applies to loan denials, benefit eligibility, hiring rejections, licensing outcomes, and disciplinary action. In each case, someone needs to look at the AI output and own the final call. Insider Note: In AI governance engagements, teams rarely struggle to show that a review step exists. What they struggle to show is that the reviewer could disagree, and sometimes did. If a human clicks “approve” on every AI recommendation and nobody ever records an override, auditors will see automation with a signature on top. Build the override path and log when people use it, starting on day one. Powers of the Authorized State Body (Ministry of Digital Technologies) ZRU-1115 makes the Ministry of Digital Technologies the authorized state body for AI. Among its new jobs, it’s

[Read more](https://axipro.co/uzbekistan-ai-regulation/)

WhatsApp us