Your Buyer Now Audits Your AI Before They Sign
Two years ago, the security questionnaire that stalled your enterprise deal asked about encryption at rest, access reviews, and whether you had a SOC 2 report.
It still asks those things. But now there’s a second section — and most B2B SaaS and financial services firms have no defensible answer to it.
Which AI systems are in scope? Who owns model risk? Where is your AI inventory? What happens when the model produces a harmful output — who finds out, and how fast?
The questions aren’t hypothetical anymore. The EU AI Act is phasing in. The Colorado AI Act is on the books. NIST AI RMF has become the reference language procurement teams borrow when they write their own diligence packets. And every enterprise buyer with a general counsel is now asking vendors to prove AI governance the same way they’ve asked them to prove information security for the last decade.
Here’s the part that matters commercially: the firms that can answer cleanly are closing deals the firms that can’t are losing.
The gap isn’t security. It’s evidence.
Most organizations we assess are not insecure. They have decent controls, competent engineers, and reasonable instincts.
What they don’t have is evidence — the documented, dated, owned, repeatable artifacts that let an auditor or an enterprise buyer verify a claim without taking your word for it.
That distinction is the whole ballgame. A control that exists but can’t be evidenced is, for audit purposes, a control that doesn’t exist. This is the single most common finding in the gap assessments we run, and it’s why “we’re basically compliant” is a sentence that costs companies six-figure contracts.
The fix isn’t more tooling. It’s structure: a management system that produces evidence as a byproduct of operating, rather than as a fire drill six weeks before an audit.
What DISC InfoSec actually does
DISC InfoSec is a boutique AI governance and cybersecurity consultancy in the SF Bay Area, working with B2B SaaS and financial services organizations. Not a platform. Not a checkbox vendor. Practitioner-led advisory from someone who has sat on both sides of the audit table.
Four service lines carry most of the work:
AI Governance & ISO 42001 (AIMS). ISO 42001 is the first international standard built specifically for AI management systems, and it layers AI-specific requirements on top of an ISO 27001-style foundation. We run the full lifecycle — AI inventory, AI system impact assessment, Statement of Applicability, AIMS policy set, internal audit, and Stage 1/Stage 2 support. If you’re already ISO 27001 certified, the incremental lift is far smaller than most teams assume, and we scope it precisely rather than selling you a second full program.
ISO 27001 & ISMS. Gap assessment through certification, including risk methodology, risk register, control implementation, and audit liaison. Where relevant, we extend into ISO 27701 for privacy (PIMS) so GDPR and CCPA obligations map to controls instead of living in a legal memo nobody operationalizes.
vCISO and vCAIO. Security and AI governance leadership at a fraction of an executive hire. Board reporting, risk governance, security strategy, customer diligence support, and the unglamorous ongoing work of keeping a program alive between audits. For companies deploying AI at any scale, the vCAIO role is increasingly the one that unblocks revenue.
Compliance readiness and risk assessment. SOC 2 readiness, NIST CSF 2.0 and NIST AI RMF mapping, EU AI Act and Colorado AI Act readiness, third-party and vendor risk, M&A cybersecurity due diligence, and web application penetration testing.
Across all of it, the operating principle is the same: map every gap to a framework requirement, rank it by priority, attach an effort estimate, and assign an owner. A roadmap that doesn’t do those four things is a document, not a plan.
The proof point
We led a virtual data room platform handling some of the most sensitive financial and legal documents in the M&A market — through ISO 42001 certification, passing Stage 2 on the first audit, with SenSiba as the certifying body. We also served as internal auditor on that engagement.
Financial data rooms are hard mode. If the AIMS holds up there, it holds up in your environment.
Credentials behind the work: CISSP, CISM, ISO 27001 Lead Implementer, ISO 42001 Lead Implementer, PECB Authorized Training Partner. Background spanning KPMG, IBM, and Intel/McAfee FoundStone, with prior engagements including NASA, Dell, Lam Research, and O’Reilly Media.
How engagements are structured
No open-ended retainers that quietly become annuities. Clear scope, fixed-fee options where the work allows:
| Package | Deliverables | Timeline |
|---|---|---|
| ISO 27001 / 42001 Gap Assessment | Baseline audit, prioritized roadmap, executive summary | 2–4 weeks |
| SOC 2 Readiness | Gap analysis, controls mapping, evidence checklist | 4–6 weeks |
| Startup Security Program | Policies, risk register, awareness training | 3–6 weeks |
Roughly half of the clients who start with a gap assessment reach full certification within twelve months — with no surprises at Stage 2, because the surprises were surfaced in week two.
Start where the risk actually is
The most expensive mistake in compliance is committing to a certification timeline before you know your real position. Scope gets discovered mid-engagement, the auditor finds a control family nobody owned, and the date slips in front of the board.
Start with an assessment. Know where you stand. Then decide what to commit to.
→ Take the Free AI Governance & ISO 42001 Readiness Assessment
Find out in 15 minutes what your auditor would find in three days.
A structured self-assessment that scores your organization across the AI governance domains that matter to auditors and enterprise buyers alike — AI inventory, risk assessment process, model documentation, bias and performance testing, security controls, incident response, vendor and third-party model risk, and stakeholder accountability.
You get back:
- A maturity score across each domain, benchmarked against certification-ready
- The specific ISO 42001 and NIST AI RMF requirements your current state does and doesn’t satisfy
- A prioritized gap list — what to fix first, and what can wait
- A realistic view of the distance between where you are and audit readiness
No sales call required to see your results. Report delivered instantly.
Start the Free Assessment → ISO 42001 gap assessment quiz
Also available at no cost on our site deurainfosec.com:
- EU AI Act Risk Classifier — classify your AI systems into prohibited, high-risk, limited-risk, or minimal-risk tiers and see the obligations that attach to each
- ISO 42001 Gap Assessment — control-by-control evaluation against the full standard, with a prioritized path to certification
- 5-Minute Security Risk Assessment — fast baseline across your information security posture
Want the results interpreted by a practitioner? Schedule a 30-minute consultation. We’ll walk your assessment output, tell you honestly whether certification is the right move this year, and scope it precisely if it is.
[ Schedule a Consultation → ] | info@deurainfosec.com | +1 (707) 998-5164
DISC InfoSec — Deura Information Security Consulting LLC. AI governance and cybersecurity consulting for B2B SaaS and financial services. Petaluma, CA / SF Bay Area. AI governance and cybersecurity consulting, ISO 42001 certification, ISO 27001 consulting, vCISO services, AI governance readiness
DISC-AI-Governance-Readiness-Assessment-1-1 pdf downloadDownload
MachineLearning & Artificial Intelligence
AI Vulnerability Scorecard: Discover Your AI Attack Surface Before Attackers Do
Your Shadow AI Problem Has a Name-And Now It Has a Score
Most AI Security Tools Won’t Pass an Audit. Here’s a 15-Minute Way to Find Out.
InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | AIMS Services | Security Risk Assessment Services | Mergers and Acquisition Securit
DISC InfoSec blog | DISC InfoSec Site | Contact us at info@deurainfosec.com
- ISO 27001 Got You in the Door. ISO 42001 Keeps You There
- The Batch Model Is Broken: Vulnerability Management in the Era of AI-Accelerated Discovery
NIST CSF 2.0 and ISO 27001: Why the Strongest Programs Use Both- Continuous NIST 800-53 Compliance: How to Stop Failing in the Eleven Months Between Audits
- AI Governance Readiness Assessment — Service
