01
Asset and risk logic
Are critical information assets, systems, services, data flows, AI applications and suppliers known and assessed with traceable risks?
Digital Industry
ISO Consulting for IT, SaaS and AI
Digital business models grow fast. Customers, investors and audits still expect reliable information security, responsibilities and traceable AI governance.
- ISO 27001
- ISO 42001
- AI governance
- Security
Context
Build trust without losing speed.
IT, SaaS and AI companies often need to answer customer questionnaires, security requirements and regulatory expectations. A good management system reduces repetitive work and creates clear ownership.
I support the setup of information security and AI management systems that fit product development and operations.
In growing teams, security, AI governance, privacy interfaces, supplier control and product development need to be considered together. Otherwise evidence is only created when a customer or auditor urgently asks for it.
Compliance landscape
The compliance landscape for IT, SaaS and AI.
Digital companies often face ISO 27001, ISO 42001, enterprise security questionnaires, privacy interfaces, NIS2 expectations in the supply chain and requirements from the EU AI Act at the same time. Cloud providers, subprocessors, development workflows, incident management and access control records add further complexity.
The compliance challenge is not only policies. What matters is whether risks, assets, permissions, suppliers, technical measures, development decisions and AI applications are current and explainable.
For SaaS and AI vendors, a management system is also a sales tool. If security and AI evidence can be answered quickly, tender, enterprise review and customer audit effort decreases.
What I provide
What Sternberg Consulting provides for digital companies.
I build information security and AI management systems pragmatically: asset and risk logic, Statement of Applicability, roles, policies, supplier evaluation, incident processes, development and change evidence, and audit planning.
For AI applications, governance is structured so purpose, responsibilities, risks, data sources, monitoring and human oversight are traceable. The system should fit product teams and not sit beside development as an extra compliance layer.
Recurring customer questions are translated into reliable evidence. Security questionnaires can then be answered from existing processes, controls and documented decisions instead of being reinvented each time.
Audit and buyer questions
What enterprise customers and auditors look for.
For IT, SaaS and AI companies, technical reality, security control and documented responsibilities must fit together. That link decides customer audit and certification readiness.
02
Statement of Applicability
Is it justified which ISO 27001 controls are implemented, excluded or planned, and does that justification match the real environment?
03
Access and operations
Are roles, permissions, logging, backups, changes, incidents and cloud responsibilities not only technically present but controllably documented?
04
AI governance
Are AI purposes, data sources, risks, human oversight, monitoring and responsibilities described so product teams can use them in practice?
05
Suppliers and cloud
Are providers, subprocessors, APIs and critical tools evaluated, monitored and included in risk assessment when changes occur?
06
Customer questionnaires
Can recurring security, privacy and AI questions be answered from existing evidence instead of writing new one-off responses each time?
Solution
Focus areas
Information security
Risks, assets, suppliers, access concepts and controls are structured and documented for audits.
More on Information securityAI management
AI applications, roles, risks, transparency and monitoring are organized pragmatically according to ISO 42001.
More on AI managementEnterprise questionnaires
Recurring security, privacy and AI questions become answerable with consistent evidence.
More on Enterprise questionnairesCustomer requirements
Requirements from tenders, contracts and audits are translated into processes, controls and responsibilities.
More on Customer requirements
Approach
Implementation for digital teams
Consulting considers product development, operations, privacy interfaces and customer expectations.
-
Understand risk situation
Products, data, AI features, customer requirements and suppliers are assessed.
-
Build a lean system
Policies, processes and evidence are designed so teams can use them in daily work.
-
Prepare audit and customer reviews
Evidence, responsibilities and interviews are prepared for certification or customer review.
After the audit
After the audit: keep security and AI evidence current.
After an ISO 27001 or ISO 42001 audit, concrete tasks usually remain: refine risks, evidence controls, improve policies, update supplier evaluations, evaluate incidents or inventory AI applications more cleanly.
I help integrate these tasks into product, engineering, security and management routines. The system stays current between audits and customer questionnaires can be answered from maintained evidence.
Next step
Get a quick view of what fits your situation.
Briefly describe your situation, the relevant standard and your timeline. You will receive a personal assessment and a concrete suggestion for the next step.
FAQ
Frequently asked questions
Can ISO 27001 and ISO 42001 be combined?
Yes. Both systems can share structures such as risks, roles, objectives, audits, actions and management review.
Is consulting suitable for start-ups?
Yes, if the system is deliberately lean and fits product maturity, customer requirements and team size.
Does every SaaS company need ISO 27001?
Not immediately. ISO 27001 becomes relevant when enterprise customers, tenders, sensitive data, investors or international customers require clear security evidence.
How do ISO 42001 and the EU AI Act relate?
ISO 42001 can help structure AI governance. The EU AI Act is a legal framework. Consulting structures the management system but does not replace legal case assessment.
What evidence do enterprise customers expect before contract signing?
Typical evidence includes policies, risk assessment, access concept, incident process, supplier overview, technical controls, privacy interfaces, audit reports and clear responsibilities.
Can ISO 27001 be prepared remotely?
Many tasks can be remote, including document review, risk workshops and evidence setup. Focused live sessions help with process understanding, interviews and technical interfaces.