ISO published the ISO 27001 standard to outline an information security management system (ISMS) in 2005. Since then, significant revisions have taken place in 2013 and 2022 to better reflect the evolving climate of cybersecurity threats and technologies.

The AI space is developing rapidly but is still largely uncontrolled. According to The State of Trust Report 2024, 62% businesses plan to invest more in AI security in the next 12 months. ‍ The good news is that AI security can now be better implemented with the help of many authoritative new AI standards and frameworks rolled out in the past few years. The aim with any of these standards is to remove the uncertainty around AI systems and ensure responsible implementation.

This past month, the Vanta team launched new features to help you: ‍

Information security is no longer optional; it’s critical to running a successful, resilient business. ISO 27001, the international standard for information security management systems (ISMS), provides a structured approach to safeguarding data. Central to this framework are the 93 controls in Annex A, which are divided into four categories: organizational, people, physical, and technological.

The NIST AI Risk Management Framework (RMF) is one of the most advanced, globally accepted guidelines for the safe and responsible use of AI systems. If your organization implements AI in any capacity, adopting the NIST AI RMF can be a significant move toward future-proofing your operations and strengthening AI trustworthiness among customers.

Trust is critical to the success of every business. And in 2024, we saw that building, scaling, and demonstrating trust is getting more difficult for organizations. ‍ Vanta’s second annual State of Trust Report uncovered key trends across security, compliance, and the future of trust. Based on a survey of 2,500 IT and business leaders in the U.S., UK, and Australia, our research found that more than half (55%) of organizations say that security risks for their business have never been higher.

With more businesses using AI models in their products or services, the inherent AI risks have made it challenging to maintain customer trust. However, according to The State of Trust Report for 2024, only 37% of organizations conduct (or are in the process of conducting) regular AI risk assessments.

The Cybersecurity Maturity Model Certification (CMMC) program was developed by the Department of Defense (DoD) to ensure that defense contractors and subcontractors meet the cybersecurity requirements needed to safely and responsibly handle government data. Of primary concern is how commercial vendors safeguard Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).

As the security expectations of customers grow and the regulatory landscape gets more complex, businesses are recognizing the value of investing in and demonstrating security. As the demand for proving compliance grows, so does the demand for HITRUST, given its reputable assessment process. ‍ Achieving HITRUST certification involves demonstrating compliance with a detailed set of controls designed to manage and mitigate information security risks.

‍Security questionnaires are a standard part of almost every due diligence process before companies sign on to work with a new third party. ‍ By asking detailed questions via questionnaires, organizations learn about a seller’s security controls and compliance with relevant standards. With that information, they determine how and if a partnership with that third party will expand their attack surface and increase risk—and ultimately decide if the increased risk is acceptable.