DISC InfoSec blogInternal Audit Archives

Aug 03 2026

ISO 27001 Got You in the Door. ISO 42001 Keeps You There

Category: Information Security,Internal Audit,ISO 27k,ISO 42001,Security Compliance,Security Risk Assessment,vCISO — disc7 @ 10:19 am

Your Buyer Now Audits Your AI Before They Sign

Two years ago, the security questionnaire that stalled your enterprise deal asked about encryption at rest, access reviews, and whether you had a SOC 2 report.

It still asks those things. But now there’s a second section — and most B2B SaaS and financial services firms have no defensible answer to it.

Which AI systems are in scope? Who owns model risk? Where is your AI inventory? What happens when the model produces a harmful output — who finds out, and how fast?

The questions aren’t hypothetical anymore. The EU AI Act is phasing in. The Colorado AI Act is on the books. NIST AI RMF has become the reference language procurement teams borrow when they write their own diligence packets. And every enterprise buyer with a general counsel is now asking vendors to prove AI governance the same way they’ve asked them to prove information security for the last decade.

Here’s the part that matters commercially: the firms that can answer cleanly are closing deals the firms that can’t are losing.

The gap isn’t security. It’s evidence.

Most organizations we assess are not insecure. They have decent controls, competent engineers, and reasonable instincts.

What they don’t have is evidence — the documented, dated, owned, repeatable artifacts that let an auditor or an enterprise buyer verify a claim without taking your word for it.

That distinction is the whole ballgame. A control that exists but can’t be evidenced is, for audit purposes, a control that doesn’t exist. This is the single most common finding in the gap assessments we run, and it’s why “we’re basically compliant” is a sentence that costs companies six-figure contracts.

The fix isn’t more tooling. It’s structure: a management system that produces evidence as a byproduct of operating, rather than as a fire drill six weeks before an audit.

What DISC InfoSec actually does

DISC InfoSec is a boutique AI governance and cybersecurity consultancy in the SF Bay Area, working with B2B SaaS and financial services organizations. Not a platform. Not a checkbox vendor. Practitioner-led advisory from someone who has sat on both sides of the audit table.

Four service lines carry most of the work:

AI Governance & ISO 42001 (AIMS). ISO 42001 is the first international standard built specifically for AI management systems, and it layers AI-specific requirements on top of an ISO 27001-style foundation. We run the full lifecycle — AI inventory, AI system impact assessment, Statement of Applicability, AIMS policy set, internal audit, and Stage 1/Stage 2 support. If you’re already ISO 27001 certified, the incremental lift is far smaller than most teams assume, and we scope it precisely rather than selling you a second full program.

ISO 27001 & ISMS. Gap assessment through certification, including risk methodology, risk register, control implementation, and audit liaison. Where relevant, we extend into ISO 27701 for privacy (PIMS) so GDPR and CCPA obligations map to controls instead of living in a legal memo nobody operationalizes.

vCISO and vCAIO. Security and AI governance leadership at a fraction of an executive hire. Board reporting, risk governance, security strategy, customer diligence support, and the unglamorous ongoing work of keeping a program alive between audits. For companies deploying AI at any scale, the vCAIO role is increasingly the one that unblocks revenue.

Compliance readiness and risk assessment. SOC 2 readiness, NIST CSF 2.0 and NIST AI RMF mapping, EU AI Act and Colorado AI Act readiness, third-party and vendor risk, M&A cybersecurity due diligence, and web application penetration testing.

Across all of it, the operating principle is the same: map every gap to a framework requirement, rank it by priority, attach an effort estimate, and assign an owner. A roadmap that doesn’t do those four things is a document, not a plan.

The proof point

We led a virtual data room platform handling some of the most sensitive financial and legal documents in the M&A market — through ISO 42001 certification, passing Stage 2 on the first audit, with SenSiba as the certifying body. We also served as internal auditor on that engagement.

Financial data rooms are hard mode. If the AIMS holds up there, it holds up in your environment.

Credentials behind the work: CISSP, CISM, ISO 27001 Lead Implementer, ISO 42001 Lead Implementer, PECB Authorized Training Partner. Background spanning KPMG, IBM, and Intel/McAfee FoundStone, with prior engagements including NASA, Dell, Lam Research, and O’Reilly Media.

How engagements are structured

No open-ended retainers that quietly become annuities. Clear scope, fixed-fee options where the work allows:

Package	Deliverables	Timeline
ISO 27001 / 42001 Gap Assessment	Baseline audit, prioritized roadmap, executive summary	2–4 weeks
SOC 2 Readiness	Gap analysis, controls mapping, evidence checklist	4–6 weeks
Startup Security Program	Policies, risk register, awareness training	3–6 weeks

Roughly half of the clients who start with a gap assessment reach full certification within twelve months — with no surprises at Stage 2, because the surprises were surfaced in week two.

Start where the risk actually is

The most expensive mistake in compliance is committing to a certification timeline before you know your real position. Scope gets discovered mid-engagement, the auditor finds a control family nobody owned, and the date slips in front of the board.

Start with an assessment. Know where you stand. Then decide what to commit to.

→ Take the Free AI Governance & ISO 42001 Readiness Assessment

Find out in 15 minutes what your auditor would find in three days.

A structured self-assessment that scores your organization across the AI governance domains that matter to auditors and enterprise buyers alike — AI inventory, risk assessment process, model documentation, bias and performance testing, security controls, incident response, vendor and third-party model risk, and stakeholder accountability.

You get back:

A maturity score across each domain, benchmarked against certification-ready
The specific ISO 42001 and NIST AI RMF requirements your current state does and doesn’t satisfy
A prioritized gap list — what to fix first, and what can wait
A realistic view of the distance between where you are and audit readiness

No sales call required to see your results. Report delivered instantly.

Start the Free Assessment → ISO 42001 gap assessment quiz

Also available at no cost on our site deurainfosec.com:

EU AI Act Risk Classifier — classify your AI systems into prohibited, high-risk, limited-risk, or minimal-risk tiers and see the obligations that attach to each
ISO 42001 Gap Assessment — control-by-control evaluation against the full standard, with a prioritized path to certification
5-Minute Security Risk Assessment — fast baseline across your information security posture

Want the results interpreted by a practitioner? Schedule a 30-minute consultation. We’ll walk your assessment output, tell you honestly whether certification is the right move this year, and scope it precisely if it is.

[ Schedule a Consultation → ] | info@deurainfosec.com | +1 (707) 998-5164

DISC InfoSec — Deura Information Security Consulting LLC. AI governance and cybersecurity consulting for B2B SaaS and financial services. Petaluma, CA / SF Bay Area. AI governance and cybersecurity consulting, ISO 42001 certification, ISO 27001 consulting, vCISO services, AI governance readiness

DISC-AI-Governance-Readiness-Assessment-1-1 pdf download Download

AI Attack Surface ScoreCard

MachineLearning & Artificial Intelligence

AI Vulnerability Scorecard: Discover Your AI Attack Surface Before Attackers Do

Your Shadow AI Problem Has a Name-And Now It Has a Score

Most AI Security Tools Won’t Pass an Audit. Here’s a 15-Minute Way to Find Out.

AIMS and Data Governance – Managing data responsibly isn’t just good practice—it’s a legal and ethical imperative

Schedule a consultation: info@deurainfosec.com

DISC InfoSec blog | DISC InfoSec Site | Contact us at info@deurainfosec.com

Tags: AI governance and cybersecurity consulting, AI governance and cybersecurity consulting Secondary: ISO 42001 certification, AI governance readiness, ISO 27001 consulting, vCISO services

Comments (0)

Mar 12 2026

AI Governance: From Frameworks to Testable Controls and Audit Evidence

Category: AI,AI Governance,Internal Audit,ISO 42001 — disc7 @ 9:12 am

AI Governance is becoming operational.

Most organizations talk about frameworks — but very few can prove their AI controls actually work.

AI governance is the system organizations use to ensure AI systems are safe, fair, compliant, and accountable. Frameworks provide the guidance, but testing produces the proof.

Here’s the practical reality across the major frameworks:

🇺🇸 NIST AI Risk Management Framework
Organizations must identify and measure AI risks. In practice, that means testing models for bias, hallucinations, and performance drift. Evidence includes risk registers, evaluation scorecards, and drift monitoring logs.

🔐 NIST Cybersecurity Framework 2.0
Cybersecurity applied to AI. Organizations must know what AI systems exist and who has access. Testing focuses on shadow AI discovery, access control validation, and security testing. Evidence includes AI asset inventories, penetration test reports, and access matrices.

🌐 ISO/IEC 42001
The emerging AI management system standard. It requires organizations to assess AI impact and monitor performance. Testing includes misuse scenarios, regression testing, and anomaly detection. Evidence includes AI impact assessments, red-team results, and KPI monitoring reports.

🔒 ISO/IEC 27001
Security for AI pipelines and training data. Controls must protect models, code, and personal data. Testing focuses on code vulnerabilities, PII leakage, and data memorization risks. Evidence includes SAST reports, PII scan results, and data masking logs.

🇪🇺 EU Artificial Intelligence Act
The first binding AI law. High-risk AI must be governed, explainable, and built on quality data. Testing evaluates misuse scenarios, bias in datasets, and decision traceability. Evidence includes risk management plans, model cards, data quality reports, and output logs.

The pattern across all frameworks is simple:

Framework → Requirement → Testing → Evidence.

AI governance isn’t about memorizing regulations.

It’s about building repeatable testing processes that produce defensible evidence.

Organizations that succeed with AI governance will treat compliance like engineering:

• Test the controls
• Monitor continuously
• Produce verifiable evidence

That’s how AI governance moves from policy to proof.

At DISC InfoSec, we help organizations translate AI frameworks into testable controls and audit-ready evidence pipelines.

#AIGovernance #AICompliance #AISecurity #NIST #ISO42001 #ISO27001 #EUAIAct #RiskManagement #CyberSecurity #AIRegulation #AITrust

Get Your Free AI Governance Readiness Assessment – Is your organization ready for ISO 42001, EU AI Act, and emerging AI regulations?

AI Governance Gap Assessment tool

15 questions
Instant maturity score
Detailed PDF report
Top 3 priority gaps

Click below to open an AI Governance Gap Assessment in your browser or click the image to start assessment.

ai_governance_assessment-v1.5Download

Built by AI governance experts. Used by compliance leaders.

At DISC InfoSec, we help organizations navigate this landscape by aligning AI risk management, governance, security, and compliance into a single, practical roadmap. Whether you are experimenting with AI or deploying it at scale, we help you choose and operationalize the right frameworks to reduce risk and build trust. Learn more at DISC InfoSec.

Tags: Audit Evidence

Comments (0)

Jan 24 2026

Smart Contract Security: Why Audits Matter Before Deployment

Category: Information Security,Internal Audit,Smart Contract — disc7 @ 12:57 pm

Smart Contracts: Overview and Example

What is a Smart Contract?

A smart contract is a self-executing program deployed on a blockchain that automatically enforces the terms of an agreement when predefined conditions are met. Once deployed, the code is immutable and executes deterministically – the same inputs always produce the same outputs, and execution is verified by the blockchain network.

Potential Use Case

Escrow for Freelance Payments: A client deposits funds into a smart contract when hiring a freelancer. When the freelancer submits deliverables and the client approves (or after a timeout period), the contract automatically releases payment. No intermediary needed, and both parties can trust the transparent code logic.

Example Smart Contract

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

contract SimpleEscrow {
    address public client;
    address public freelancer;
    uint256 public amount;
    bool public workCompleted;
    bool public fundsReleased;

    constructor(address _freelancer) payable {
        client = msg.sender;
        freelancer = _freelancer;
        amount = msg.value;
        workCompleted = false;
        fundsReleased = false;
    }

    function releasePayment() external {
        require(msg.sender == client, "Only client can release payment");
        require(!fundsReleased, "Funds already released");
        require(amount > 0, "No funds to release");
        
        fundsReleased = true;
        payable(freelancer).transfer(amount);
    }
}

Fuzz Testing with Foundry

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import "forge-std/Test.sol";
import "../src/SimpleEscrow.sol";

contract SimpleEscrowFuzzTest is Test {
    SimpleEscrow public escrow;
    address client = address(0x1);
    address freelancer = address(0x2);

    function setUp() public {
        vm.deal(client, 100 ether);
    }

    function testFuzz_ReleasePayment(uint256 depositAmount) public {
        // Bound the fuzz input to reasonable values
        depositAmount = bound(depositAmount, 0.01 ether, 10 ether);
        
        // Deploy contract with fuzzed amount
        vm.prank(client);
        escrow = new SimpleEscrow{value: depositAmount}(freelancer);
        
        uint256 freelancerBalanceBefore = freelancer.balance;
        
        // Client releases payment
        vm.prank(client);
        escrow.releasePayment();
        
        // Assertions
        assertEq(escrow.fundsReleased(), true);
        assertEq(freelancer.balance, freelancerBalanceBefore + depositAmount);
        assertEq(address(escrow).balance, 0);
    }

    function testFuzz_OnlyClientCanRelease(address randomCaller) public {
        vm.assume(randomCaller != client);
        
        vm.prank(client);
        escrow = new SimpleEscrow{value: 1 ether}(freelancer);
        
        // Random address tries to release
        vm.prank(randomCaller);
        vm.expectRevert("Only client can release payment");
        escrow.releasePayment();
    }

    function testFuzz_CannotReleaseMultipleTimes(uint8 attempts) public {
        attempts = uint8(bound(attempts, 2, 10));
        
        vm.prank(client);
        escrow = new SimpleEscrow{value: 1 ether}(freelancer);
        
        // First release succeeds
        vm.prank(client);
        escrow.releasePayment();
        
        // Subsequent attempts fail
        for (uint8 i = 1; i < attempts; i++) {
            vm.prank(client);
            vm.expectRevert("Funds already released");
            escrow.releasePayment();
        }
    }
}

Run the fuzz tests:

forge test --match-contract SimpleEscrowFuzzTest -vvv

Configure fuzz runs in foundry.toml:

[fuzz]
runs = 10000
max_test_rejects = 100000

Benefits of Smart Contract Audits

Security Assurance: Auditors identify vulnerabilities like reentrancy attacks, integer overflows, access control flaws, and logic errors before deployment. Since contracts are immutable, catching bugs pre-deployment is critical.

Economic Protection: Bugs in smart contracts have led to hundreds of millions in losses. An audit protects both project funds and user assets from exploitation.

Compliance & Trust: For regulated industries or institutional adoption, third-party audits provide documented due diligence that security best practices were followed.

Gas Optimization: Auditors often identify inefficient code patterns that unnecessarily increase transaction costs for users.

Best Practice Validation: Audits verify adherence to standards like OpenZeppelin patterns, proper event emission, secure randomness generation, and appropriate use of libraries.

Reputation & Adoption: Projects with reputable audit reports (Trail of Bits, OpenZeppelin, Consensys Diligence) gain user confidence and are more likely to attract partnerships and investment.

Given our work at DISC InfoSec implementing governance frameworks, smart contract audits parallel traditional security assessments – they’re about risk identification, control validation, and providing assurance that systems behave as intended under both normal and adversarial conditions.

DISC InfoSec: Smart Contract Audits with Governance Expertise

DISC InfoSec brings a unique advantage to smart contract security: we don’t just audit code, we understand the governance frameworks that give blockchain projects credibility and staying power. As pioneer-practitioners implementing ISO 42001 AI governance and ISO 27001 information security at ShareVault while consulting across regulated industries, we recognize that smart contract audits aren’t just technical exercises—they’re risk management foundations for projects handling real assets and user trust. Our team combines deep Solidity expertise with enterprise compliance experience, delivering comprehensive security assessments that identify vulnerabilities like reentrancy, access control flaws, and logic errors while documenting findings in formats that satisfy both technical teams and regulatory stakeholders. Whether you’re launching a DeFi protocol, NFT marketplace, or tokenized asset platform, DISC InfoSec provides the security assurance and governance documentation needed to protect your users, meet institutional due diligence requirements, and build lasting credibility in the blockchain ecosystem. Contact us at deurainfosec.com to secure your smart contracts before deployment.

Tags: Smart Contract Audit

Comments (1)

Dec 03 2025

Why Auditing AI Is Critical for Responsible and Secure Adoption

Category: AI,AI Governance,Internal Audit — disc7 @ 1:51 pm

Managing AI Risks Through Strong Governance, Compliance, and Internal Audit Oversight

Organizations are adopting AI at a rapid pace, and many are finding innovative ways to extract business value from these technologies. As AI capabilities expand, so do the risks that must be properly understood and managed.
Internal audit teams are uniquely positioned to help organizations deploy AI responsibly. Their oversight ensures AI initiatives are evaluated with the same rigor applied to other critical business processes.
By participating in AI governance committees, internal audit can help set standards, align stakeholders, and bring clarity to how AI is adopted across the enterprise.
A key responsibility is identifying the specific risks associated with AI systems—whether ethical, technical, regulatory, or operational—and determining whether proper controls are in place to address them.
Internal audit also plays a role in interpreting and monitoring evolving regulations. As governments introduce new AI-specific rules, companies must demonstrate compliance, and auditors help ensure they are prepared.
Several indicators signal growing AI risk within an organization. One major warning sign is the absence of a formal AI risk management framework or any consistent evaluation of AI initiatives through a risk lens.
Another risk indicator arises when new regulations create uncertainty about whether the company’s AI practices are compliant—raising concerns about gaps in oversight or readiness.
Organizations without a clear AI strategy, or those operating multiple isolated AI projects, may fail to realize the intended benefits. Fragmentation often leads to inefficiencies and unmanaged risks.
If AI initiatives continue without centralized governance, the organization may lose visibility into how AI is used, making it difficult to maintain accountability, consistency, and compliance.

Potential Impacts of Failing to Audit AI (Summary)

The organization may face regulatory violations, fines, or enforcement actions.
Biased or flawed AI outputs could damage the company’s reputation.
Operational disruptions may occur if AI systems fail or behave unpredictably.
Weak AI oversight can result in financial losses.
Unaddressed vulnerabilities in AI systems could lead to cybersecurity incidents.

My Opinion

Auditing AI is no longer optional—it is becoming a foundational part of digital governance. Without structured oversight, AI can expose organizations to reputational damage, operational failures, regulatory penalties, and security weaknesses. A strong AI audit function ensures transparency, accountability, and resilience. In my view, organizations that build mature AI auditing capabilities early will not only avoid risk but also gain a competitive edge by deploying trustworthy, well-governed AI at scale.

Governance in The Age of Gen AI: A Director’s Handbook on Gen AI

Tags: AI Internal Audit

Comments (0)

Mar 28 2025

Preparing for an ISO Audit: Essential Tips and Best Practices for a Successful Outcome

Category: Information Security,Internal Audit,ISO 27k — disc7 @ 2:44 pm

”Preparing for an ISO Audit: Tips and Best Practices” is a comprehensive guide by AuditCo, published in February 2025, aimed at assisting organizations in effectively preparing for ISO audits. The article outlines several key strategies:

Understanding ISO Standards: It emphasizes the importance of familiarizing oneself with the specific ISO standards relevant to the organization.
Conducting a Pre-Audit: The guide recommends performing a self-assessment to identify and address areas of non-compliance before the official audit.
Organizing Documentation: Ensuring that all pertinent documents, such as policies and records, are well-organized and easily accessible is highlighted as a crucial step.
Training Employees: Providing staff with training on the audit process and their respective roles is advised to facilitate a smoother audit experience.
Engaging with Auditors: Establishing open communication with auditors to clarify expectations and address concerns is also recommended.

Additionally, the article suggests best practices like creating an audit checklist, involving top management to demonstrate commitment to compliance, monitoring corrective actions for identified non-conformities, and implementing improvements post-audit to enhance the management system.

For a detailed exploration of these strategies, you can read the full article

Full Preparation Plan for an ISO Audit

1. Understand the ISO Standard :

– Familiarize yourself with the specific ISO standard relevant to your organization (e.g., ISO 27001 for Information Security, ISO 9001 for quality management, ISO 14001 for environmental management, ISO 45001 for occupational health and safety).

– Study the standard requirements and guidelines to fully grasp what is expected.

2. Gap Analysis :

– Conduct a thorough gap analysis to compare your current processes and systems against the ISO standard requirements.

– Identify areas that need improvement and document these gaps.

3. Develop an Implementation Plan :

– Create a detailed plan to address the gaps identified in the gap analysis.

– Assign responsibilities to team members, set timelines, and allocate necessary resources.

4. Training and Awareness :

– Train your employees on the ISO standard requirements and the importance of compliance.

– Ensure that everyone understands their roles and responsibilities related to the ISO standards.

5. Document Control :

– Develop or update documentation to meet ISO requirements, including policies, procedures, work instructions, and records.

– Implement a document control system to manage and maintain these documents efficiently.

6. Internal Audits :

– Conduct internal audits to evaluate your readiness for the ISO audit.

– Identify non-conformities and take corrective actions to address them.

– Internal audits should closely mimic the external audit process.

7. Management Review :

– Hold a management review meeting to assess the effectiveness of your ISO management system.

– Ensure top management is involved and committed to the process.

8. Pre-Audit Assessment :

– If possible, conduct a pre-audit assessment with an external consultant to get an objective evaluation of your readiness.

– Use the feedback to make any necessary adjustments before the actual audit.

9. Audit Logistics :

– Coordinate with the external auditor to schedule the audit.

– Prepare all necessary documentation and ensure key personnel are available during the audit.

10. Continuous Improvement :

– ISO audits are not a one-time event. Implement a culture of continuous improvement to maintain compliance and enhance your management system.

– Regularly review and update your processes and systems to ensure ongoing compliance.

ISO 27001 INTERNAL AUDITS & DATA PROTECTION: STRENGTHENING COMPLIANCE & SECURITY: A Practical Guide to Conducting Internal Audits and Safeguarding Sensitive Data (ISO 27001:2022)

Tags: ISO 27001 Internal Audit, ISO Audit Plan

Comments (9)

Feb 25 2025

Difference Between Internal and External Audit

Category: Internal Audit — disc7 @ 8:42 am

Feature	Internal Audit	External Audit
Objective	Evaluates internal controls, risk management, and compliance to improve efficiency.	Provides an independent opinion on financial statements and compliance with regulations.
Conducted By	Internal employees or outsourced auditors reporting to management or the board.	Independent third-party auditors hired by shareholders or regulators.
Focus	Operational effectiveness, risk management, and compliance.	Accuracy and fairness of financial statements.
Regulation	Not legally required but recommended for governance.	Mandatory for public companies and regulated entities.
Frequency	Ongoing, conducted throughout the year.	Typically conducted annually.
Reporting	Reports to management and the board (Audit Committee).	Reports to shareholders and regulatory authorities.
Independence	May lack full independence due to internal employment.	Fully independent from the organization.

Internal audits help improve internal processes, while external audits ensure compliance and financial integrity. First party audits, known as internal audits, consider the effectiveness and efficiency of the Management System, whereas external audits consider only the effectiveness of the Management System.

ISO certification training courses.

ISMS and ISO 27k training

Tags: External Audit, Internal audit

Comments (13)

DISC InfoSec blog

ISO 27001 Got You in the Door. ISO 42001 Keeps You There

Your Buyer Now Audits Your AI Before They Sign

The gap isn’t security. It’s evidence.

What DISC InfoSec actually does

The proof point

How engagements are structured

Start where the risk actually is

→ Take the Free AI Governance & ISO 42001 Readiness Assessment

Start the Free Assessment → ISO 42001 gap assessment quiz

AI Governance: From Frameworks to Testable Controls and Audit Evidence

Smart Contract Security: Why Audits Matter Before Deployment

Smart Contracts: Overview and Example

What is a Smart Contract?

Potential Use Case

Example Smart Contract

Fuzz Testing with Foundry

Benefits of Smart Contract Audits

DISC InfoSec: Smart Contract Audits with Governance Expertise

Why Auditing AI Is Critical for Responsible and Secure Adoption

Managing AI Risks Through Strong Governance, Compliance, and Internal Audit Oversight

Potential Impacts of Failing to Audit AI (Summary)

My Opinion

Preparing for an ISO Audit: Essential Tips and Best Practices for a Successful Outcome

Full Preparation Plan for an ISO Audit

Difference Between Internal and External Audit

ISO certification training courses.

Follow DISC InfoSec blog

Get new posts by email:

DISC online store for recommended InfoSec products

vCISO as a service