RESEARCH GUIDE · 10 PAGES
Research guide to AI management and security
Questions, sources, boundaries and evidence for researching a well-scoped AI use case.
Read PDF · Spanish ↗← Research
ISO · IA / AI
AI research guides and good practices.
42001 addresses AI management; 27090 provides guidance on security threats to AI systems. NullGhost is opening a research direction to turn both perspectives into verifiable practices.
Research guide and good-practice manual.
Working versions v0.2 · PDFs in Spanish · Technical review pending
MANUAL · 9 PAGES
AI good-practice manual
Inventory, risks, tests and prepublication review. Includes four editable CSV templates on GitHub.
Read PDF · Spanish ↗This is a proposed roadmap, not a claim of certification, conformity or complete implementation. The initial review uses ISO public descriptions; both full standards must be reviewed before producing a clause-level mapping.
Two complementary perspectives
ISO/IEC 42001:2023 specifies requirements for an artificial intelligence management system. Its official entry lists publication in December 2023.
ISO/IEC 27090:2026 provides guidance on security threats and compromises to AI systems throughout their life cycle. ISO records publication on 14 October 2026.
How we propose to apply them at NullGhost
Management: define the AI uses in scope, accountable owners and decisions requiring human review. Maintain records of risks, decisions and improvements.
Technical protection: inventory data, models, tools and dependencies; design authorized tests of untrusted inputs, agent permissions and information exposure. These tests are a NullGhost proposal, not an automatic equivalence to ISO clauses.
Evidence: link each conclusion to its authorization, test, result and limits. Preserve negative results and differences between browsers instead of hiding them.
How to use these documents
The research guide proposes connecting governance, technical threats and traceability in an AI workflow using MCP tools and a virtualized lab. Client cases will remain outside public content unless disclosure is specifically authorized.
The manual organizes objectives, activities, accountable owners, expected evidence and verification criteria. Normative mapping remains pending until the full standards and implementation have been reviewed.
Status and next steps
19 October 2026: official references verified and editorial proposal prepared. Research guide and good-practice manual available as working versions v0.2; technical review and empirical validation pending.