AI Governance Readiness: ISO/IEC 42001 and NIST AI RMF
Your AI workloads on Amazon Bedrock and Amazon SageMaker assessed against ISO/IEC 42001 and the NIST AI Risk Management Framework, delivering a GRC-ready control set and a board briefing.
- Duration
- 4 weeks
- Standards
- ISO 42001 + NIST AI RMF
- Output
- GRC-ready control set
- Investment
- $18,500
Built for a specific situation
- Teams running generative AI on Amazon Bedrock or SageMaker with no formal governance framework
- Companies receiving customer questionnaires about AI risk, model governance, or training data handling
- Organizations pursuing ISO/IEC 42001 certification that need a gap analysis before engaging a certification body
- Security and risk leaders asked by the board to explain how AI risk is actually managed
AWS services in scope
Amazon Bedrock
Including Bedrock Guardrails configuration and model evaluation practices
Amazon SageMaker AI
Model governance, model cards, and model registry practices
Amazon Q
Enterprise deployment patterns and data-access boundaries
AWS CloudTrail
Logging and auditability of model invocation and AI system activity
Amazon Macie and AWS KMS
Sensitivity classification of training and retrieval data, and encryption of models and prompts
AWS IAM
Model access boundaries, least privilege, and separation of duties for AI systems
How the engagement runs
1 · Discovery
Workshops with your AI, security, and legal stakeholders to inventory use cases, data flows, and ownership.
2 · Environment review
Read-only review of Bedrock, SageMaker, and related AWS configuration through a scoped IAM role.
3 · Gap analysis
Assessment against ISO/IEC 42001 Annex A controls and the NIST AI RMF Govern, Map, Measure, and Manage functions.
4 · Delivery
Policy set, control set, and board briefing delivered and walked through within four weeks of kickoff.
What you receive
- AI system inventory across your AWS accounts with owners, data flows, and risk classification
- ISO/IEC 42001 gap analysis against Annex A controls, scored with evidence gaps identified
- NIST AI RMF mapping across Govern, Map, Measure, and Manage
- AI governance policy set covering acceptable use, model approval, data handling, human oversight, and AI incident handling
- Control set formatted for import into your GRC platform
- Board-ready briefing on your AI risk posture
Sample 42001 gap analysis
An excerpt of the Annex A scoring and the control set format you receive.
Delivered by
- CISSP with a governance, risk, and compliance specialization
- Active U.S. SECRET clearance
- 18 years leading engineering, product, and security at global communications providers
- Built a complete security and IT program for ~275 employees across four countries after an acquisition
- Hands-on ISO/IEC 27001, ISO/IEC 42001, NIST AI RMF, and CMMC 2.0 implementation experience
- AWS practitioner since 2011 and former AWS Partner Program administrator
Governance that lives in your system of record
Most AI governance engagements end with a report. This one ends with a control set your GRC platform can import, so the governance position can be maintained, evidenced, and audited rather than refreshed from scratch at the next customer review.
Contact
Every engagement is delivered personally by Brian Govanlu, CISSP.
Readiness and advisory, not certification
Engagements are readiness and advisory services; they do not constitute certification, which must be performed by an accredited body.
Any AWS infrastructure costs you incur remain your responsibility and are separate from the engagement fee.
Professional services are separate from the CMDash auditor and assessor directory. How that directory stays neutral is set out in the Independence Covenant.