Walter Haydock: Welcome to the Deploy Security podcast, where we go deep on the cybersecurity, privacy, and compliance implications of using artificial intelligence. I'm your host, Walter Haydock, founder of StackAware. Today, I'm joined by David Foreman. David is the CEO of Mastermind, a US pure play ISO certification body, and the first globally accredited to issue the ISO IEC 42001 AI ⁓ Management System Certificate. He brings real world auditable AI governance into regulated environments like healthcare and life sciences. A long time ISO lead auditor and instructor for a variety of different standards. He previously built and scaled Coal Fire's ISO certification practice, giving him deep practical experience, translating security, privacy, and resilience requirements into certification ready programs. David, welcome to the show.
David Forman: Walter, so happy to be here and thanks for having me. I feel like I've finally made it being on the podcast. So I appreciate the invite, accommodating my schedule, but also talking all things ISO.
Walter Haydock: Well, I did have to tell another guest that we have literally dozens of people watching and listening to this. So you should count yourself lucky.
David Forman: We'll get that to like multiple dozens, maybe hundreds at some point. ⁓
Walter Haydock: That's right. That's right. Hey, my YouTube channel is growing. It is growing. So yeah, we'll get you out there. That's right. That's right. Yeah, you can I'll put my hand in front of my face. You can see there's this.
David Forman: love it. Authentic content is going to win the age of AI slop. So let's do it. I don't want to do that because I'm fake. Thank you. Yeah, there you go.
Walter Haydock: Proof of personhood, please. Yeah. Yeah. So before we dive into all the ISO good stuff, I really do want to talk about kind of the world travel aspect of your life, which I know you've talked about a lot. And, know, as a company founder, how do you A, make time for it? B, how do you deal with like all the logistical issues of setting up? know, maybe you're like, you know, on the other side of the world right now doing this podcast. So Can you talk me through that, what got you into travel and kind of how you work that into your life and your business?
David Forman: Yeah. So I am in fact in Atlanta right now. I'm at home office. I am not traveling at the moment, but yeah, it is a, say more or less an interesting fact about me. I've been to 50 countries, five zero, ⁓ as of the recording of this podcast, but I, I'll be honest, I hope to not hit the next like 50 milestone, ⁓ because, ⁓ it's been exhausting. So, ⁓ with world travel, which is such a luxury to be able to even be able to go visit other countries. ⁓ I would say there's probably out at 50 that I've been to like. that I want to go back to actually. So like you eventually find, I'll say, stuff that makes you happy and entertained while you're like traveling abroad. I like to focus on good food, but I also, you know, I'm lazy so I like to focus on countries that speak English. But that also kind of goes against like what is my favorite country in the world, which is Japan. So there's very little English there, but the food's so good so it makes up for it. ⁓ How I got into it originally to answer that kind of first question, I actually got into points and miles like credit card, like game, like very early on. ⁓ It was ⁓ probably 2010 roughly. I was ⁓ getting out of university and ⁓ I stumbled upon a blog that's very popular now called The Points Guy. But The Points Guy was in its infancy at the time. They're on New York and if you know the founder, Brian Kelly, is kind of an eccentric guy. But ⁓ he was doing a lot of blogging at the time around like points and miles a game, how you can like, you know, stay in these like luxury resorts and stuff like that and not pay thousands of dollars and you just like convert credit card points. And ⁓ I was ⁓ Going out of school, my first job was at Ernst & Young and I knew I was going to be doing some travel for UI. And I was like, all right, I got to like make sure like my credit card game is like, the strategy is very like defined going into this because I'm only going to have a few shots to really start determining loyalty to hotels and airlines. And ⁓ I started like, I'll say getting very obsessed with credit card points and miles to the point where, you know, back in the day, this is like far pre pandemic, you would fly out on a Sunday night. ⁓ You go to a client site for four or five days in a You'd be flying back on the red eye at the end of the week and I would start adding segments purposely into that travel. like for example, if I landed at like San Francisco, I would get to San Francisco by flying out on a Sunday morning, not Sunday night, and I would connect through Dallas and Seattle and then I'd end up in San Francisco just to get the extra segments. And you know, this is young 20s David, he has all the time in the world. But I would find airfare that was actually cheaper than the direct flight, but it be like
Walter Haydock: You
David Forman: extra segments in there. So I got into world travel through that and then I didn't love obviously traveling for work but what I did love was obviously at the points I was getting from that I could then convert it into personal travel and so I've done awesome trips like unfortunately again through that have largely been paid for through those points. ⁓ One of the cooler ones was in 2019 I went to Vanuatu which is in ⁓ South Pacific and ⁓ I went to specifically in Vanuatu Tana Island which is this kind of remote island has a very active volcano on called Mount Yasser and ⁓ the people on there are very primitive ⁓ and I was able to like spend three days with them in their villages like hike this volcano and like I mean there was a guy there he had never seen somebody that was Caucasian and like it's just like really cool to have those types of experiences but that's all comes from the consulting travel game.
Walter Haydock: Interesting, ⁓ interesting story. And yeah, one thing that you mentioned that I find super interesting is that direct flights can be more expensive than circuitous routes.
David Forman: Especially Atlanta, because Delta Airlines basically has a monopoly here in Atlanta. This is their headquarters and their hub. And so you can fly out of, and my wife's done this before, Chattanooga, Tennessee, which is about an hour and a half drive from Atlanta. connect back through Atlanta and then fly to South Korea, which she did this route, and she saved $1,500 on a one-way trip to Seoul, South Korea, instead of flying direct from Atlanta to Seoul. And it's because there's more competition out at Chattanooga Airport than there is out of Atlanta. that was a, maybe that's an Atlanta unique thing, but just wherever these airlines are hubbed, if there's less competition, then it's worse for the consumer.
Walter Haydock: You would think that the fuel costs would outweigh that, but apparently not. Apparently not. Yeah.
David Forman: Dynamic pricing based on what they think consumers will pay. Yeah, I think that's what it is. We can talk about surveillance pricing later. That's an AI topic.
Walter Haydock: Yeah, interesting. Yeah, yeah, definitely. I think you and I actually might have some disagreements on that, but we'd love to drill into it. Definitely, yeah. I mean, let's just dive into it right now before we get into ISO 42001. So yeah, I I guess I'll lay out my understanding of the topic and then let you chime in on it. So it's pretty well understood that there are pretty well-trained machine learning algorithms that identify
David Forman: There you go. I'm overdoing it. Yeah. Yeah. Sure.
Walter Haydock: various characteristics about consumers. And you mentioned airlines and credit cards and like a big driver for airlines to issue credit cards so that they can understand your spending habits so that they can price you appropriately. know, the alternate, they would probably say, well, yeah, you know, but we're compensating you. We're giving you points. We're giving you status. We're giving you these freebies, blah, blah, blah. And, you know, it's difficult in 2026 because the individual consumer is faced with this vast array of data and processing that's kind of arrayed against them. And there are people, you know, kind of like the points guy who are kind of like guides through the maze and who can, ⁓ if you have the gumption and you have the interest, you can kind of flip the system on its head a little bit. But I think for the vast majority of people, they're unfortunately kind of just. the system happens to them. They're not like navigating through the system. They are the product. They are the product. And you know, you could say like, well, even for those people, their standard of living is still increasing. ⁓ You know, although I think like pricing is inflation has been has been a big issue over the past five years, at least since since the pandemic. So, you know, generally I'd say there there's there's is neither good nor bad. And you can use you can use predictive pricing. You can use
David Forman: I agree. They're more the product in that case.
Walter Haydock: You know, some people would call it price customization. Some people would call it price discrimination. Some people would call it surveillance pricing. I would say that it's neither good nor bad. And there are ethical ways to deploy it in there, you know, potentially unethical ways to deploy it. Where do you see the line being drawn?
David Forman: Yeah, I mean, I think you touched on it right at the last point. So I'm not totally against surveillance pricing, to be honest, or I think people also call it dynamic pricing. So I'll give you a couple scenarios. Delta Airlines, hometown airline for me. If they see that I am surfing the internet prior to going to delta.com and I go to 1800flowers.com and I'm buying funeral arrangement flowers in the same session prior to me accessing delta.com. And they think based on that cookie that's getting shared across these data brokers that maybe I'm about to buy a flight to go to a funeral. Therefore it's time bound. I got to be on that flight. Gonna have to make it to New York for grandma who passed away hypothetically. Is that ethical knowing that I was about to buy funeral arrangement flowers on during the same session and now you see that I have an urgency. Like, could you charge me more for it because you my tolerance for the price is going to be reduced in that situation due to the event that I'm trying to make. I find ethical grounds there to be debatable. Where I'll say on the flip side of this, say they monitor David and they know that David is using, I'm just trying to think of a good example this. For example, when you are accessing on your mobile device, there is a ID that's being shared with the application provider. ⁓ Basically identifying the device type so they can see that David has the most current iPhone for example ⁓ a month after its release we can make a Probably probable assumption that David is a little bit more fluent being that he is able to get the latest and greatest Version the iPhone a month after release. That's a luxury item Therefore maybe we can charge David at slightly higher price because of him showing this element or data point of affluence then somebody who's access on their Windows phone, which has been deprecated 10 years. If that's the case, I would have, I'll say, a little bit more issue on the ethics line too, just because we're essentially taxing the rich in that case differently than somebody else trying to get a one-to-one commodity. The third example I'll give on this is, and this is where I think I'll agree more with the other side of house. If you are getting a better service because of information being shared, I'll liken this to the insurance industry today in the US. You have options as a consumer. You can go to an agent in a physical working-mortar office and you can say, hey, State Farm agent, help me determine a quote for my home auto motorcycle, whatever, okay? That's a very personal experience compared to I could go online to esurance.com or Lemonade, one of these like online insurance providers, get an online quote, no personal experience whatsoever and probably get a cheaper rate. If I'm doing anything where my data is creating a better customer experience for me, such as Amazon on their app, like showing me stuff that I might be interested in, and it's actually right that I'm actually interested in this type of stuff, I'm in the market for this. Like, I think there is a premium to be paid there. And I'm okay paying that premium, I'll say ethically as well, especially if I haven't opted out of certain like cookie consent or other sort of data sharing. So I'll agree with you on this. I don't think surveillance pricing is necessarily bad in 100 % cases. I think it should have guardrails because I do think there are ethical lines to draw where it's like, hey, somebody that is in dire need of making it to New York for that funeral, using my other scenario here, I think that crosses a line, at least for me, ethically.
Walter Haydock: Understood. Yeah, I guess I would say, well, what if it's a wedding that you
David Forman: Yeah. ⁓ As long as I'm... It's a tough one. For me, I don't care. ⁓ I think I'm maybe in a different situation, but I'll say, if I need to get to that wedding, I'm gonna pick probably the most direct route on my preferred airline. I'm not the type that's shopping to say, I'm going to fly out of Chattanooga to go to make it to New York and I'm positive to connect. Or honestly, if there's even a $150 price difference between Delta and Southwest out of Atlanta, I'm still probably picking Delta because I have loyalty with them and points and miles game again, where I probably use that for personal travel later on too. So I think it's important to make the consumer knowledgeable. I think it's important for the consumer to know how their data is being used. I'm big on transparency around that. If there is a convenience factor where I'm trying to do something really quick, I think ultimately it's up to the consumer for them to judge whether or not they're okay paying that price in a vacuum.
Walter Haydock: I'll give you one more chance to respond after I say this. I'll give you the last word here. I would say that I brought up the wedding because that's a little, assume there's a moral line. ⁓ I don't know why I got thumbs down.
David Forman: Sure. I want to hear it. Mm. I didn't like you saying moral. ⁓
Walter Haydock: Yeah, yeah, I know. Yeah, so Apple embeds in their webcams this weird, ⁓ man, are you kidding me? Are you thumbs downing me right now, Apple? No, I know, I know you're not. No, this is on my end. This is on my end, this is on my end. need a, yeah, so you cannot, you can only disable the reactions. Yeah, I think I just disabled it. You can only disable the reactions. Yeah, I'll give you a thumbs up.
David Forman: I'm not doing it. I just think your opinion is not welcome right now, Walter. Okay, I'm out. ⁓ yeah.
Walter Haydock: You can only disable them after the video has started. can't globally disable them. And it's like, yeah, it's so, it comes up in like sales calls and stuff. like, I'm sorry, this is unprofessional. Cause I'm like getting this floating thumbs up thing. Yeah.
David Forman: There That's funny. It's like capturing your change in tone. It's like, ⁓ he's disagreeing.
Walter Haydock: Yeah, yeah, exactly, exactly. Yeah, so I really do not like that feature. Not at all related to surveillance pricing, just like a bad feature. Yeah, you wanna talk about like, man, Apple's just like, why don't we just move all the fields and buttons around? Yeah, no, please don't do that. I know where everything is. Anyway, back to surveillance pricing. I brought up the wedding because assume there's a line somewhere like.
David Forman: Yeah. Thank you.
Walter Haydock: that's really closer to the okay side of the line if it's not already over it. Yeah, there's a spectrum, there's gonna be gray area throughout. And especially in the case of machine learning, like the way that that pricing prediction is made, it's gonna be through ⁓ maybe a linear regression model that has multiple different ⁓ inputs into it. So it's actually gonna be like very difficult to tell what factor is actually
David Forman: I would agree, sir.
Walter Haydock: triggering the final price or it's going to be accommodation of factors. know, maybe if it's, if it's Elon Musk, who's, who's getting on the plane for, for a funeral, although I'm sure he flies private, but assume somebody just wealthy, just wealthy enough to not afford private is this line commercial, you know, I would say, well, I'm not, I'm not too worried about it. You know, obviously there are different scenarios, but basically my point is that there's a lot of, there's a ton of gray. And especially with machine learning, like it gets even
David Forman: I'll put it this way, I think it's no different than people saying, ⁓ I don't want Facebook turning off my photos I upload to it. You as a consumer still have the choice of whether or not you're gonna use Facebook. You don't have to have a Facebook account. And additionally with this, you as a consumer... You don't have to buy that ticket. There's situations more dire than others. And I think that line that Greer you're talking about is like a wedding technically is opportunistic. Whereas like maybe a funeral or let's think of another like you're going for a medical treatment that only you can get in New York. Like if that was to be the case, like you're running more in a dire scenario and now it's really unfortunate you have to pay even extra to do that because some some signal you sent on the internet shows urgency. And I would say like being able to at least give the consumer like options ⁓ when it comes to that and it's not being some sort of like monopoly like in terms of like this is only one flight that gets you there on time. Like that's that's where I say like hey like let the consumer still decide they want to pay that price or not. Like who cares if like they're getting a different price than somebody else. Like if they're knowledgeable and like hey what that is. So ⁓ I sit on kind of the fence on that to be honest. I think it's scenario dependent. I do think I want to know what are those signals that are determining dynamic pricing for me and my consumer behavior. And I also want to be able to opt out and I also want to be able to work in incognito mode, for example. I think you always hear people say when you're researching airline or airfare, it's been for years, they say open up a private browser window. until you're ready to buy. Otherwise, can ensure traffic and interest on that specific flight, and it's going to possibly raise up the prices because of pricing. So that's been like that for years. I've also seen in the past, too, like certain airlines, like if you access the English version of the website versus the Spanish version, for example, like you get a higher price being that they know your English speaker versus Spanish speaker, for example. Yeah, it's been around a lot longer than Chachi Petit.
Walter Haydock: Well, that was a good conversation on that topic and appreciate your thoughts on that. So I think there's a good segue to move into the ISO 40 2001 side of things, which is yes, yes, to both of us. And so the standards brand new for a lot of organizations, obviously you were at the bleeding edge from the certification body side of things. What are the top three misconceptions you see leaders have about it and what it covers and what it doesn't?
David Forman: Yeah. Near and Yeah, that's a good point. First of all, I think what we're seeing right now with kind of the rise of AIUC1 too, like we're seeing some of those gaps that are coming out. I'd say for 2001 it's a management system standard by definition and if you're unfamiliar with what a management system is for any listener, it's essentially a governance program and that's how you should view for 2001. It's a governance framework. I hate saying framework because it's really a scheme, but like it's a governance framework for like how you maintain and like can improve on as part of some sort of feedback loop like whatever AI things are affecting your organization. And you're familiar with this, Walter, but for others, like the stakeholder roles within ISO 400 2001 are really important too. When we think about am I a producer or developer? Am I a provider? Am I a user? Thinking about how you fit into the shared responsibility model of AI use cases with possibly a frontier model, a third party LLM. I think that's really important to understand too, to just kind of where your line is in terms of responsibility. Where I'll go further with this, if you asked me a year ago, I'd say, The kind of biggest pitfall we'd see in 40,000 initial certification clients was a lot like couldn't understand like or get their hands around what a system impact assessment was. They one didn't understand like, you know, how granular to get on like the definition of a system. Like some try to do it like governance program wide. Others would get down to a product level. Some would get down to a feature level. And then others also didn't know like how deep do you go into like a system impact assessment? If you're a deployer of some sort, like maybe you have like accuracy reporting to do to like be able to check for hallucinations in the model through different outputs or use cases. I'd say that's more of a problem of 2025. I think a lot of our customers have kind of like... found templates or found stuff that works like for them at this point. I've gotten more expertise on it. I've gotten more competent themselves. Now what we're seeing in 2026, kind of like for the surveillance lot of customers coming back around, the flavor of the day I've been noticing, and this sounds lame, but it's like change management. And what I mean by that is very few companies have the same kind of risk profile as OpenAI and Anthropic. Most of them are plugging into a third party LLM for some sort of gen AI application and being an AI provider. where we see issues in year two. is they went through a system impact assessment in year one on, I'll give an example, like ChatGBT, like 4.0, and now they're using 5.2 for OpenAI. ⁓ But they did an impact assessment at 5.0, didn't do one at 5.2. Like, what is considered a major change for them? Like, when are you reevaluating that underlying model or system card in terms of, is it still having the same safeguards you originally thought when you were white labeling essentially on your platform for end customers? Additionally, moving from 5.0 to 5.1, is that a major change or is that a minor change? mean, even OpenAI doesn't issue a new model card every time they have a new version update like that, a new model variant. If I go in, I'm looking for better use of my tokens or better capacity of an LLM in a moment, and I now want to use diverse providers, and I have anthropic and OpenAI now, or perplexity, something like that. Is that considered a new system impact assessment if it's just a new vendor coming into the scope or if the use case is the same? Could we all just kind of recycle that same impact assessment and I'll tell you a lot of organizations I think are kind of failing at like defining what is change management for them They don't understand what is major versus minor change in this context like they do for like pushing code of production and I think that's gonna be a little bit of a learning curve because I don't think we've even really defined it that well as an industry
Walter Haydock: I think change management is absolutely a huge issue that a lot of companies do not define well, especially when it comes to AI. And this is something that I'm helping our clients with right now is when a new version of GPT 5.4 comes out, then what do you do? And what we're doing right now is we're tracking, you know, the Vectara Hallucination Leaderboard, which is an open source data data set. You know, we're pushing updates as soon as the kind of UI based versions because they automatically change. And we're also tracking, you know, the risk of model drift is something that we need to stay on top of in our risk register. It's something we recommend to our customers because like you mentioned, things are moving fast and organizations haven't necessarily figured out how they're going to stay on top of it.
David Forman: I'll give one other kind of I'll say trend I'm noticing too. You would imagine like 2024, 2025, kind of the early adopters are going to be big tech essentially. And now we're starting to see this kind of come into like, you know, more everyday use cases as we call, but also more of these boring industries, right? Like manufacturing. And I had a call literally today with a manufacturer. I guess you could call him that. And I asked them about, they actually asked me about I support 2001, which is interesting. I didn't think the topic was going go that way. We were talking about 27,000 originally which makes way more sense for them and I was like, what do you want to know about 40 2001? And they said, well, we don't have any AI like, you features or things like, you know, from like a SaaS application standpoint, but we know we're using it. I was like, well, there's a stakeholder role for that. There's AI user. And, um, and they said, but we don't really have a policy around it. Our policy is just block all AI. Like, I'm like, oh my, that's an interesting strategy in 2026 to block all AI. And I said, all right, if that's your policy right now, do you think you're effectively doing it? And they said, we're doing it from like a DLP and like org like standpoint. Um, but what we're not doing is. we're not effectively doing it within TPRM. We're not effectively doing it with. you know, I'll say being able to monitor our own employees of data leakage. I'm like, that last part, double click on that. What do mean by that? And they said, we send out an anonymous survey and we found out that employees being that we don't have a company wide approved AI solution for LLMs and gen AI and like a chatbot. They are using their personal devices and putting in company information in those personal devices, you know, swearing on the Bible that they're not like putting any sensitive information in there. and getting their free chat GBT, I guess, mobile app to spit out an AI summary for them and then they're using that for their work. I said, that feels like a way bigger risk than just approving an AI solution for the company to use. I said, you guys just need to get on chat GBT team tomorrow. That's crazy. So when you think about companies that take this hard stance, being resistant to change and saying, ⁓ we're not gonna allow AI because we don't want any of our data being used for training of models, that's always the buzzword. uncertainty and doubt, FUD, that you're talking about is actually creating a new risk for you where employees are gonna find workarounds to that policy and they're gonna do something far more insecure. And I would say like that's kind of the trend we're at now, which is let's say big tech, they're early adopters, are they figured it out completely? Absolutely not, like still learning curve, but for those more antiquated industries that say we're just not gonna like pay attention to what's happening in the world of AI. I think they're creating these risks unknowingly with their own workforce that's possibly leaking, I'll say, sensitive information.
Walter Haydock: And I'm sure those employees are saying something like, I've worked for a manufacturing company in the Southwestern United States. And then opening eyes like, ⁓ look at this IP address. I wonder which firm this is. And they're training on the data because they're using the free version. So yeah, yeah. Yeah.
David Forman: Yep. ⁓ and it's on a free version of chat GBT, which you have no protections on. It's crazy.
Walter Haydock: Yeah. Yeah, I think ⁓ the, don't use AI is, an interesting stance. actually wrote an article on how there are multiple failure modes of that stance itself. There are multiple ways in which taking that approach can, can go wrong. So I definitely agree with you.
David Forman: Yeah. Well, I'll tell you this too, like from a third-party risk management standpoint, like show me, say you have a hundred suppliers. I guarantee you out of a hundred suppliers, over 90 of them had AI baked into something as their as a service model to you. Um, if not more, to be honest. And so if you're taking the stance that we're not using AI, like I would say your entire TBRM strategies screwed up at that point. But I also had somebody tell me at one point too, which I thought was interesting. They said, we don't struggle. I'll say flagging any of these AI vendors coming in to our like onboarded, like supplier program, whatever they said, we struggle with the existing ones. that have been embedded in our company for 10 years plus. They're on auto renewal schedules. Like the contract only gets re-reviewed once every five, 10 years because it's low spend. And they add an AI feature overnight. It's a little toggle. And there's five users in the 100,000 person company that use this tool on a daily basis. They're all in marketing and they see this little like new feature flag pop up on the app and they just hit it and say, yeah, I want to start getting AI summaries. And like just overnight now you have this supplier that was low risk now turn into high risk. per your policy of blocking all AI because they're summarizing all your marketing content. And I'd say that's a huge issue for TBRM teams that work off of any sort of vendor tiering model to do vendor due diligence reviews because they have to basically go re-tier everybody and they have to also be very, I'll say, current on what are those features and whether or not any of are AI enabled.
Walter Haydock: That's absolutely a huge challenge. And that's something that we are working with our customers on. We recently introduced a new feature on our end on the Stackware side, basically whenever we're capturing evidence for any sort of assessment, we do two things. One, we capture an archive.org version of the page. So it's like timestamped. Yeah. So we timestamp it. And then we pull a hash of the page as it is today when we're making the assessment.
David Forman: ⁓ yeah? ⁓ that's interesting. Yeah. Yeah.
Walter Haydock: And then when we go back, what happens is, first of all, we check the hash. If the hash is the same, then the page hasn't changed. So there's no, don't need to do anything. If the hash has changed, we send out an OpenAI API call to see what the change was compared to the previous data. If there's a change, then we flip that over. We've got an analyst who's doing human review of that type of information to make sure that the AI is getting it right. So yeah.
David Forman: Yeah, totally. Yeah. Wow. So is that page like, are you archiving the terms of use or something? What are you archiving? Yeah. Terms of use, privacy notices. Yeah. Those could all do it. Interesting. That's creative, Walter. I like that. That's very creative.
Walter Haydock: Yeah, that's one example. That's one example is like turn. Yeah. Yeah. Terms of service is a big, is a big one. Yeah. Yeah. Yeah. You know, and that is now part of our, our ISO 42001 AI management system is tracking that we're tracking, you know, rates of human override and, or confirmation.
David Forman: Tell your auditor that's a key strength, because I haven't seen that. That sounds really good. Yeah. That's neat.
Walter Haydock: Yeah, using AI to govern AI. Yeah. Yeah, that's the goal. The key thing is like the cost because, you know, just having a human expert like check everything is challenging. It takes a lot of time and ⁓ skill. really getting the AI up to the point where like it's not because it'll come it'll like nitpick things. It'll be like, ⁓ know, change's happening glad. I'm like, that's not it. We don't need to review that.
David Forman: Yep.
Walter Haydock: That's not that was not a material change. You know, don't don't do.
David Forman: I have a couple of tasks, this should probably be like a topic in itself, but like just basically how you're using it, like in your business and like personal life. But I have a couple of tasks that are set up right now where I monitor web pages for just like changes, like typically to like leadership teams and stuff. Um, and I tell like, don't email me unless there is a change. So like the task is running daily, but technically I'm not seeing a bunch of noise on unless there's actually any material change. But like, if I see like, you know, a company gets a new CEO or something, a new CSA, something more relevant to our industry. Um, like I'll. especially if I'm already connected to that person on LinkedIn, it'll basically tell me, go send them a message and graduate them or something so I'm more personal. But these use cases are just getting like, I like what I just heard from you, that's so creative. I think that's where it's one thing to have somebody that has access to the same tooling, but this is just another level of, again, synthesis and comprehension of understanding how you can apply something to actually make your management system like.
Walter Haydock: Mm-hmm. Yeah.
David Forman: that much better too in current. It's a form of continuous monitoring in all reality, which, ⁓ you know, talk about flaws of ISO standards. I hate the fact that they're like point in time audits, like once a year, like much rather have something more continuous monitoring. And I think that's where all these compliance schemes are going here in the future too, like trust and errors and service, but ⁓ you can make it better than what the scheme is itself, like what it says in the heart requirements. And that's what you're doing. That's pretty cool. Yeah.
Walter Haydock: Yeah, I mean, you know, at a minimum, you'd have to do an annual risk assessment. But like from a realistic perspective, you got to be moving faster.
David Forman: Yeah. You want it pretty active. That's a living document. Your risks are changing quickly. Yeah. Interesting.
Walter Haydock: Yeah. Yeah, yeah, definitely. Yeah, so on that note, you know, we kind of talked about some misconceptions and ⁓ have you seen some governance theater out there? Have you seen some companies that kind of are sprinkling some fairy dust on it, so to speak?
David Forman: Yeah, and so I'm in a competitor marketplace. I'm not going to name competitors by any means, but what I will say, and to be honest, I feel like it can happen to the best of us. It's interesting seeing these ISO 4001 certificates. I pulled it up before this call actually, and I was looking at the current IAF search, search market intelligence, like data analytics, which I'm sure you've seen screenshots in the past. But certification-wise, I have access to the back end of IAF search, search, and you can see how many globally accredited 4001 certificates there are today. There's a couple of search fields you can play around with, but how I have it filtered is showing 292 current 4001 certificates as of 24 hours ago that are uploaded to the database. Compare that to ISO 27000. which has been around for a couple decades now and the ISO forum even longer under British standard moniker, there is over 80,000 on IFS research. So we are like super, super early innings for 2001 right now. ⁓ Getting back to your kind of point around like some governance compliance theater. ⁓
Walter Haydock: ⁓ wow.
David Forman: There are some large names that have gotten 42,000 certified here early in 2025. And it's comical because like a week or two later after they got certified and did their big PR push. there was then another PR about them getting breached related to their AI features, discriminating, leaking information, whatever. And I'll put it this way. We talked about this earlier about 40-2009, like it's a governance framework in all reality. And I've been close to other breaches where there's been an ISO 27,000 certification, it's like two type two report in place and that company still gets breached. It doesn't mean that they weren't meeting the compliance or conformity scheme team, it means they had a hole that obviously wasn't proactively identified and ⁓ their management system for whatever reason was deficient. And if you understand these ISO management system standards well, versus I'll say how they maybe are marketed in the external marketplace, they are designed to be continuous improvement models, as we call it. ⁓ it doesn't mean just cause I got ISO 27,000 certified or 40,000 certified that I am perfectly secure. It's not even a safe harbor, ⁓ and under most regulation. ⁓ it's just means that I have a program in place to practically identify deficiencies and weaknesses and to address those. have top management commitment. have appropriate like roles and responsibilities set up. I have risk assessment to at least try to capture like enterprise level, like items related to that risk taxonomy. ⁓ so there's, think a lot of, ⁓ I'll say misnomer is out. there around like, hey, I get 27,000 certified, I am a secure organization. No, it means you have a information security management system, AKA governance program in place, and you guys are doing the right things in terms of monitoring information security vulnerabilities, but it doesn't necessarily mean that you are continuously being monitored, that you are meeting those SLAs. So. I always try to start with that. ⁓ The other theater, just to give you something that's a little bit more precise an example, I had a conversation on this earlier this week too. There was a client, well not client, prospect that reached out and we ultimately didn't move forward because they were trying to do something in my mind that was a little bit misrepresentative. They were trying to scope an ISO 42001 certificate at the time of application to something so narrow that it just wasn't representative of what that company does. The company is an AI native company. They literally say it in the company name. It's on a tagline underneath their logo on their website. You go to their website. It's literally part of the subheader that you see on your browser window. And they were scoping it down to this one AI feature out of, I'll say, more than 10 that they have that are available on their services page. And we're trying to say out of a, I think about 500 person scope that like five people weren't scoped to that because they were like scoping it down to like just like the product managers for that one feature. And I told them, said, look, like theoretically you can scope however you want for ISO. Like that's one of the, I'll say benefits, but also cons of the standard. ⁓ But as an auditor, I have to make sure that the scope one makes sense, but also isn't going to be misrepresented to an in reader of the report. And I said, my concern here is you are known for all these other things. it's not necessarily this thing. And I said, if you go out and do a PR after getting certified in 40 2001, you would have to have such precise language in that PR saying what was scoped in that I think it's just nearly impossible that you're gonna be able to get a consistent message out of your sales and marketing teams after the fact. I I see a lot of risk with this type of scope statement. And they said, well, we only want to do this piece because the other pieces we don't think are actually conforming to the standard yet. I was like, I was like, call me back when you, the other piece was born in the standard. said, because this little tiny carve out, like I'm all for like having a foundation to build off of. But I said, this is like a little bit misleading. And I, I'm not sure they love that conversation because I've heard through the grapevine. They've solicited some other auditors now, but it is theater in my opinion. Like you don't say stack aware for this very specific product. as I say, 40,000 certified, like colloquially, you're just verbally talking to somebody, say, Stackware is 40,000 certified, very normal. ⁓ However, like if you look at like use of marks and like how you're actually supposed to represent it, you typically just refer back to the certificate and you say, look for that for the precise detail in terms of what was in scope. And because there's kind of, say differences and discrepancies between those two statements, I don't feel comfortable certifying just like a little tiny carve out of a much larger organization that has a different reputation. But that's where a lot of theater is right now. People are trying to do the bare minimum to say they have a 42,000 certificate somewhere in their organization with the hope that somebody doesn't kind of go another layer deeper during procurement.
Walter Haydock: That's definitely an interesting observation. think that could cause some issues operationally too, if you're kind of in one meeting and you're like, well, are we talking about this product or this product? if we're in scope that we need to do this, if we're out of scope, we need to do that. So I think you could be harming yourself from a business perspective as well.
David Forman: Think about a vendor supplier like due diligence questionnaire you receive. It never says, is this XYZ product ISO 27001 certified? It says, is your company ISO 27001 certified? So at best, like if they're asking.
Walter Haydock: At best, at best. Usually I get like, are you ISO? And I have to, say, yes, yes, yes or no, yes or no. I'm like, yes, I guess. Right. Yeah. Yeah. And you gotta love those security questionnaires that really, really are, are, are focused on the nuance of things.
David Forman: So for that specific use case, that salesperson could probably guess because like, we have it somewhere in the company. Like, and I think it's misleading. Yeah. Well, it's comments like, are you ISO certified? And you say yes. And it's like, all right, cool. Now tell us about every control and ISO 27,000. You're like, what? You're re-liking me? Yeah.
Walter Haydock: That's aggressive. That's aggressive. ⁓ Yeah, yeah, I remember back in the day when, well, I I fill out security questionnaires now, but I was really doing a lot of an old job. And the best one I got was like, it was a completely locked Excel sheet. And there's only yes or no. And it was like, confirm that you have discovered no software vulnerabilities in your product in the past 18 months. And I was like, is this a test? to see if people are going to say yes. Because like, if anyone ever said yes, I'd be like, ⁓ you're either lying or you're not looking, both of which are very bad. Or, well, yeah, not look, I would consider not looking. Yeah, yeah, I would consider not looking to be incompetent.
David Forman: Yeah. We're incompetent. We have to deal with this ability and your vulnerability, something like that. There's like no like field like add like explanatory notes or anything like that. That's funny.
Walter Haydock: No, no is yes or no. And I was like, no, because obviously anyone who's ever run a vulnerability scan gets a Christmas tree the first time that they look at
David Forman: Thank Yeah, so then you did the no and you got 20 more questions added. That's what happened.
Walter Haydock: But the thing is, I've gotten like two follow-up questions to security questionnaires in my life. And yeah, go ahead.
David Forman: Yeah, that's funny. I, one of the things I push back on constantly, and I don't know how this is viewed by people, but I never accept right to audit clauses in any of my service agreements. I get audited by accreditation bodies for this exact purpose, but it kind of stinks as a certification body to be honest. Like I can't have an ISO 27,000 certificate or 40,000 certificate from my company. Like I'm not allowed to get certified as a certification body. I get accredited. How many procurement people know what ISO 17021 is? Very few. And they don't understand what goes into that and the fact that we're actually building a management system that has a quality system for that. I get buried in these supplier questionnaires and then I always reject the right to audit clause because I'm like, that's why you guys are in a accreditation audit every year. I said, it's not for you to audit me. I said, also, I'm your auditor. This is weird.
Walter Haydock: Yeah, I've actually used ISO 400001 as a way to negotiate a way right to audit from customers. Because I'm like, I am getting audited. I'll show you my certificate. Yeah. Yeah.
David Forman: From a write to audit? Any third party audit that's doing like information security adjacent something like that should be more effective than like you spending resources to write to audit us. Yeah.
Walter Haydock: And I've been through customer audits at previous companies and like, you know, you're starting at like, okay, this is JIRA. And then the auditor's like, what's JIRA? And you're like,
David Forman: I mean, it's typically, your point, think it's a more junior person typically performing those audits because it's not a fun job.
Walter Haydock: Yeah, yeah, yeah. Cool. Well, so moving on, ⁓ we talked about scope and yeah, so want to talk about continuous improvement because that's something we discussed a little bit. You know, when you're evaluating ⁓ AI systems, like you use the risk assessment to drive your application of NXA controls. Have you seen some companies apply those controls in a, know, especially impressive or innovative manner over time? they doing things that are kind of out of the box in a good way?
David Forman: Yeah, I'll put it this way. One of the things I was disappointed with when 42,001 was first published as final international standard, actually that's confusing neurology, not as FDIS, but as the international standard in December, 2023. There's 38 annex A controls, as you're aware. And I would say about a third of them are more or less redundant with the clauses. If you don't know how to apply them really, like, but. You could probably meet those control objectives or control descriptions by just having really robust like clause type like evidence as well. So I don't like the kind of duplicative nature of parts of Annex A. The parts of Annex A that I do like are like more like inventory based like SDLC type requirements, obviously TPRM, which comes up in the final like subdomain A10. And then anything around like more, I'll paraphrase here, but like transparency notices. So like, this is how we plan to use AI. Talking about that in not only contracts, but in just like general notices available to any like prospects. I think that's like more of the value of ISO 400 in my opinion is almost having a third party auditor come in there and say, all right, you have this like privacy notice equivalent that you're passing out to end customers. Are you actually doing that? And someone auditing to that like that design. So to answer your question short, the most mature companies I've seen so far with ISO 400001 and applying those controls is those controls have to be a starting point and only a starting point. They cannot be the end game. If you look at the standard for what it is, like it is, and the ISO standards this way, but it is built to be a scheme that you can conform to as a two person company, but also as a 200,000 person company. And in order for that to be one size fits all, you have to apply kind of the risk-based approach you're talking about there. Like it just doesn't make sense otherwise. So like what Amazon's going to do is going to look very different than what Stackware is going to do for their 40,2001 certification. And both are certified, congratulations. ⁓ But your management system is going to look largely different than each other. Not only because of your stakeholder role, but also because of just like the risk of plugging the type of company you are and the size of the company you are. With that being said, I always try to, I'll say tie any Annex A control development ⁓ to a bigger problem or objective or use case than just, want to be ISO 40000 certified. If that's your initial goal, that's fine. That's a good foundation. But for those controls to operate well and to develop and continuously improve well over time, they have to be tied back to a business objective. And so ⁓ one of the business objectives I'd say is probably the most common right now, like just kind of these early innings again for AI governance and just LLMs coming on the market and consumers actually using LLMs, not just businesses. is I think just, I keep harping on it, but transparency. So like the best companies out there are the ones, and this is totally an opinion, ⁓ are the ones that are being very forthcoming about how we utilize AI in our services, ⁓ what type of training and models we are doing, even if it's just training on like metadata, not necessarily the information you're putting in as a user into these tools. ⁓ And then trying to give consumers, similar to like privacy and data subject access request type ⁓ capabilities, trying to give them options in terms of how they want to interact and how they want their data to be stored, retained, or ⁓ utilized through these services as well. Those are the ones that I think are just like, they see the light in terms of where this is all going, not only with regulation, but also where consumer preference is. And my best customers are the ones that are very, I'll say, public with those AI use cases and how they're training models. I think that's important to be. And I think they're winning, the ones that are more transparent and more open about it than the ones that are trying to kind of operate, like saying, oh, we barely use AI in our services. think that's kind of theater, to be honest.
Walter Haydock: Yeah, think transparency is the best policy. So we're actually getting toward toward time. This has been a great discussion and would love to give you an opportunity at the end to plug whatever you'd like to mastermind your travel blog.
David Forman: I'm going to travel in. Yeah, no, Mastermind Assurance is our full name. You can find us at mastermindassurance.com. When you go to our web page, you'll see that we are very narrowly focused, just like this conversation was. We work with just a subset of ISO management system standards, the ones that we believe are the most important to today's SaaS companies and other as a service models. That is ISO 27001 for information security, ISO 27701 for data privacy. Of course, ISO 42001 for responsible use of AI as well as some extensions. I said 2017, 2017, 2018, CSA star certification, all kind of making up what I call the modern like CIA triad. So if you're familiar with like confidentiality, integrity, availability, which was I say was like InfoSec from 15, 20 years ago. I think today's CIA triad is kind of three pillars. You have this information security, privacy pillar, and then the third pillar is actually horizontal. It's this underlying kind of like infrastructure of AI that has influenced InfoSec and data privacy. And I just think we gotta be honest with ourselves, like we cannot have true data protection either for our own users or in customers without considering the risk with AI. So if you wanna talk more about that and you wanna be audited and possibly even certified to this very cool standard ISO 400001, please give us a call. Mashminesurance.com.
Walter Haydock: David, thank you so much for coming on and to our audience, thank you for tuning in. This has been the Deploy Security Podcast and we will see you next time.
David Forman: Thanks Walter.
David Forman: Walter, so happy to be here and thanks for having me. I feel like I've finally made it being on the podcast. So I appreciate the invite, accommodating my schedule, but also talking all things ISO.
Walter Haydock: Well, I did have to tell another guest that we have literally dozens of people watching and listening to this. So you should count yourself lucky.
David Forman: We'll get that to like multiple dozens, maybe hundreds at some point. ⁓
Walter Haydock: That's right. That's right. Hey, my YouTube channel is growing. It is growing. So yeah, we'll get you out there. That's right. That's right. Yeah, you can I'll put my hand in front of my face. You can see there's this.
David Forman: love it. Authentic content is going to win the age of AI slop. So let's do it. I don't want to do that because I'm fake. Thank you. Yeah, there you go.
Walter Haydock: Proof of personhood, please. Yeah. Yeah. So before we dive into all the ISO good stuff, I really do want to talk about kind of the world travel aspect of your life, which I know you've talked about a lot. And, know, as a company founder, how do you A, make time for it? B, how do you deal with like all the logistical issues of setting up? know, maybe you're like, you know, on the other side of the world right now doing this podcast. So Can you talk me through that, what got you into travel and kind of how you work that into your life and your business?
David Forman: Yeah. So I am in fact in Atlanta right now. I'm at home office. I am not traveling at the moment, but yeah, it is a, say more or less an interesting fact about me. I've been to 50 countries, five zero, ⁓ as of the recording of this podcast, but I, I'll be honest, I hope to not hit the next like 50 milestone, ⁓ because, ⁓ it's been exhausting. So, ⁓ with world travel, which is such a luxury to be able to even be able to go visit other countries. ⁓ I would say there's probably out at 50 that I've been to like. that I want to go back to actually. So like you eventually find, I'll say, stuff that makes you happy and entertained while you're like traveling abroad. I like to focus on good food, but I also, you know, I'm lazy so I like to focus on countries that speak English. But that also kind of goes against like what is my favorite country in the world, which is Japan. So there's very little English there, but the food's so good so it makes up for it. ⁓ How I got into it originally to answer that kind of first question, I actually got into points and miles like credit card, like game, like very early on. ⁓ It was ⁓ probably 2010 roughly. I was ⁓ getting out of university and ⁓ I stumbled upon a blog that's very popular now called The Points Guy. But The Points Guy was in its infancy at the time. They're on New York and if you know the founder, Brian Kelly, is kind of an eccentric guy. But ⁓ he was doing a lot of blogging at the time around like points and miles a game, how you can like, you know, stay in these like luxury resorts and stuff like that and not pay thousands of dollars and you just like convert credit card points. And ⁓ I was ⁓ Going out of school, my first job was at Ernst & Young and I knew I was going to be doing some travel for UI. And I was like, all right, I got to like make sure like my credit card game is like, the strategy is very like defined going into this because I'm only going to have a few shots to really start determining loyalty to hotels and airlines. And ⁓ I started like, I'll say getting very obsessed with credit card points and miles to the point where, you know, back in the day, this is like far pre pandemic, you would fly out on a Sunday night. ⁓ You go to a client site for four or five days in a You'd be flying back on the red eye at the end of the week and I would start adding segments purposely into that travel. like for example, if I landed at like San Francisco, I would get to San Francisco by flying out on a Sunday morning, not Sunday night, and I would connect through Dallas and Seattle and then I'd end up in San Francisco just to get the extra segments. And you know, this is young 20s David, he has all the time in the world. But I would find airfare that was actually cheaper than the direct flight, but it be like
Walter Haydock: You
David Forman: extra segments in there. So I got into world travel through that and then I didn't love obviously traveling for work but what I did love was obviously at the points I was getting from that I could then convert it into personal travel and so I've done awesome trips like unfortunately again through that have largely been paid for through those points. ⁓ One of the cooler ones was in 2019 I went to Vanuatu which is in ⁓ South Pacific and ⁓ I went to specifically in Vanuatu Tana Island which is this kind of remote island has a very active volcano on called Mount Yasser and ⁓ the people on there are very primitive ⁓ and I was able to like spend three days with them in their villages like hike this volcano and like I mean there was a guy there he had never seen somebody that was Caucasian and like it's just like really cool to have those types of experiences but that's all comes from the consulting travel game.
Walter Haydock: Interesting, ⁓ interesting story. And yeah, one thing that you mentioned that I find super interesting is that direct flights can be more expensive than circuitous routes.
David Forman: Especially Atlanta, because Delta Airlines basically has a monopoly here in Atlanta. This is their headquarters and their hub. And so you can fly out of, and my wife's done this before, Chattanooga, Tennessee, which is about an hour and a half drive from Atlanta. connect back through Atlanta and then fly to South Korea, which she did this route, and she saved $1,500 on a one-way trip to Seoul, South Korea, instead of flying direct from Atlanta to Seoul. And it's because there's more competition out at Chattanooga Airport than there is out of Atlanta. that was a, maybe that's an Atlanta unique thing, but just wherever these airlines are hubbed, if there's less competition, then it's worse for the consumer.
Walter Haydock: You would think that the fuel costs would outweigh that, but apparently not. Apparently not. Yeah.
David Forman: Dynamic pricing based on what they think consumers will pay. Yeah, I think that's what it is. We can talk about surveillance pricing later. That's an AI topic.
Walter Haydock: Yeah, interesting. Yeah, yeah, definitely. I think you and I actually might have some disagreements on that, but we'd love to drill into it. Definitely, yeah. I mean, let's just dive into it right now before we get into ISO 42001. So yeah, I I guess I'll lay out my understanding of the topic and then let you chime in on it. So it's pretty well understood that there are pretty well-trained machine learning algorithms that identify
David Forman: There you go. I'm overdoing it. Yeah. Yeah. Sure.
Walter Haydock: various characteristics about consumers. And you mentioned airlines and credit cards and like a big driver for airlines to issue credit cards so that they can understand your spending habits so that they can price you appropriately. know, the alternate, they would probably say, well, yeah, you know, but we're compensating you. We're giving you points. We're giving you status. We're giving you these freebies, blah, blah, blah. And, you know, it's difficult in 2026 because the individual consumer is faced with this vast array of data and processing that's kind of arrayed against them. And there are people, you know, kind of like the points guy who are kind of like guides through the maze and who can, ⁓ if you have the gumption and you have the interest, you can kind of flip the system on its head a little bit. But I think for the vast majority of people, they're unfortunately kind of just. the system happens to them. They're not like navigating through the system. They are the product. They are the product. And you know, you could say like, well, even for those people, their standard of living is still increasing. ⁓ You know, although I think like pricing is inflation has been has been a big issue over the past five years, at least since since the pandemic. So, you know, generally I'd say there there's there's is neither good nor bad. And you can use you can use predictive pricing. You can use
David Forman: I agree. They're more the product in that case.
Walter Haydock: You know, some people would call it price customization. Some people would call it price discrimination. Some people would call it surveillance pricing. I would say that it's neither good nor bad. And there are ethical ways to deploy it in there, you know, potentially unethical ways to deploy it. Where do you see the line being drawn?
David Forman: Yeah, I mean, I think you touched on it right at the last point. So I'm not totally against surveillance pricing, to be honest, or I think people also call it dynamic pricing. So I'll give you a couple scenarios. Delta Airlines, hometown airline for me. If they see that I am surfing the internet prior to going to delta.com and I go to 1800flowers.com and I'm buying funeral arrangement flowers in the same session prior to me accessing delta.com. And they think based on that cookie that's getting shared across these data brokers that maybe I'm about to buy a flight to go to a funeral. Therefore it's time bound. I got to be on that flight. Gonna have to make it to New York for grandma who passed away hypothetically. Is that ethical knowing that I was about to buy funeral arrangement flowers on during the same session and now you see that I have an urgency. Like, could you charge me more for it because you my tolerance for the price is going to be reduced in that situation due to the event that I'm trying to make. I find ethical grounds there to be debatable. Where I'll say on the flip side of this, say they monitor David and they know that David is using, I'm just trying to think of a good example this. For example, when you are accessing on your mobile device, there is a ID that's being shared with the application provider. ⁓ Basically identifying the device type so they can see that David has the most current iPhone for example ⁓ a month after its release we can make a Probably probable assumption that David is a little bit more fluent being that he is able to get the latest and greatest Version the iPhone a month after release. That's a luxury item Therefore maybe we can charge David at slightly higher price because of him showing this element or data point of affluence then somebody who's access on their Windows phone, which has been deprecated 10 years. If that's the case, I would have, I'll say, a little bit more issue on the ethics line too, just because we're essentially taxing the rich in that case differently than somebody else trying to get a one-to-one commodity. The third example I'll give on this is, and this is where I think I'll agree more with the other side of house. If you are getting a better service because of information being shared, I'll liken this to the insurance industry today in the US. You have options as a consumer. You can go to an agent in a physical working-mortar office and you can say, hey, State Farm agent, help me determine a quote for my home auto motorcycle, whatever, okay? That's a very personal experience compared to I could go online to esurance.com or Lemonade, one of these like online insurance providers, get an online quote, no personal experience whatsoever and probably get a cheaper rate. If I'm doing anything where my data is creating a better customer experience for me, such as Amazon on their app, like showing me stuff that I might be interested in, and it's actually right that I'm actually interested in this type of stuff, I'm in the market for this. Like, I think there is a premium to be paid there. And I'm okay paying that premium, I'll say ethically as well, especially if I haven't opted out of certain like cookie consent or other sort of data sharing. So I'll agree with you on this. I don't think surveillance pricing is necessarily bad in 100 % cases. I think it should have guardrails because I do think there are ethical lines to draw where it's like, hey, somebody that is in dire need of making it to New York for that funeral, using my other scenario here, I think that crosses a line, at least for me, ethically.
Walter Haydock: Understood. Yeah, I guess I would say, well, what if it's a wedding that you
David Forman: Yeah. ⁓ As long as I'm... It's a tough one. For me, I don't care. ⁓ I think I'm maybe in a different situation, but I'll say, if I need to get to that wedding, I'm gonna pick probably the most direct route on my preferred airline. I'm not the type that's shopping to say, I'm going to fly out of Chattanooga to go to make it to New York and I'm positive to connect. Or honestly, if there's even a $150 price difference between Delta and Southwest out of Atlanta, I'm still probably picking Delta because I have loyalty with them and points and miles game again, where I probably use that for personal travel later on too. So I think it's important to make the consumer knowledgeable. I think it's important for the consumer to know how their data is being used. I'm big on transparency around that. If there is a convenience factor where I'm trying to do something really quick, I think ultimately it's up to the consumer for them to judge whether or not they're okay paying that price in a vacuum.
Walter Haydock: I'll give you one more chance to respond after I say this. I'll give you the last word here. I would say that I brought up the wedding because that's a little, assume there's a moral line. ⁓ I don't know why I got thumbs down.
David Forman: Sure. I want to hear it. Mm. I didn't like you saying moral. ⁓
Walter Haydock: Yeah, yeah, I know. Yeah, so Apple embeds in their webcams this weird, ⁓ man, are you kidding me? Are you thumbs downing me right now, Apple? No, I know, I know you're not. No, this is on my end. This is on my end, this is on my end. need a, yeah, so you cannot, you can only disable the reactions. Yeah, I think I just disabled it. You can only disable the reactions. Yeah, I'll give you a thumbs up.
David Forman: I'm not doing it. I just think your opinion is not welcome right now, Walter. Okay, I'm out. ⁓ yeah.
Walter Haydock: You can only disable them after the video has started. can't globally disable them. And it's like, yeah, it's so, it comes up in like sales calls and stuff. like, I'm sorry, this is unprofessional. Cause I'm like getting this floating thumbs up thing. Yeah.
David Forman: There That's funny. It's like capturing your change in tone. It's like, ⁓ he's disagreeing.
Walter Haydock: Yeah, yeah, exactly, exactly. Yeah, so I really do not like that feature. Not at all related to surveillance pricing, just like a bad feature. Yeah, you wanna talk about like, man, Apple's just like, why don't we just move all the fields and buttons around? Yeah, no, please don't do that. I know where everything is. Anyway, back to surveillance pricing. I brought up the wedding because assume there's a line somewhere like.
David Forman: Yeah. Thank you.
Walter Haydock: that's really closer to the okay side of the line if it's not already over it. Yeah, there's a spectrum, there's gonna be gray area throughout. And especially in the case of machine learning, like the way that that pricing prediction is made, it's gonna be through ⁓ maybe a linear regression model that has multiple different ⁓ inputs into it. So it's actually gonna be like very difficult to tell what factor is actually
David Forman: I would agree, sir.
Walter Haydock: triggering the final price or it's going to be accommodation of factors. know, maybe if it's, if it's Elon Musk, who's, who's getting on the plane for, for a funeral, although I'm sure he flies private, but assume somebody just wealthy, just wealthy enough to not afford private is this line commercial, you know, I would say, well, I'm not, I'm not too worried about it. You know, obviously there are different scenarios, but basically my point is that there's a lot of, there's a ton of gray. And especially with machine learning, like it gets even
David Forman: I'll put it this way, I think it's no different than people saying, ⁓ I don't want Facebook turning off my photos I upload to it. You as a consumer still have the choice of whether or not you're gonna use Facebook. You don't have to have a Facebook account. And additionally with this, you as a consumer... You don't have to buy that ticket. There's situations more dire than others. And I think that line that Greer you're talking about is like a wedding technically is opportunistic. Whereas like maybe a funeral or let's think of another like you're going for a medical treatment that only you can get in New York. Like if that was to be the case, like you're running more in a dire scenario and now it's really unfortunate you have to pay even extra to do that because some some signal you sent on the internet shows urgency. And I would say like being able to at least give the consumer like options ⁓ when it comes to that and it's not being some sort of like monopoly like in terms of like this is only one flight that gets you there on time. Like that's that's where I say like hey like let the consumer still decide they want to pay that price or not. Like who cares if like they're getting a different price than somebody else. Like if they're knowledgeable and like hey what that is. So ⁓ I sit on kind of the fence on that to be honest. I think it's scenario dependent. I do think I want to know what are those signals that are determining dynamic pricing for me and my consumer behavior. And I also want to be able to opt out and I also want to be able to work in incognito mode, for example. I think you always hear people say when you're researching airline or airfare, it's been for years, they say open up a private browser window. until you're ready to buy. Otherwise, can ensure traffic and interest on that specific flight, and it's going to possibly raise up the prices because of pricing. So that's been like that for years. I've also seen in the past, too, like certain airlines, like if you access the English version of the website versus the Spanish version, for example, like you get a higher price being that they know your English speaker versus Spanish speaker, for example. Yeah, it's been around a lot longer than Chachi Petit.
Walter Haydock: Well, that was a good conversation on that topic and appreciate your thoughts on that. So I think there's a good segue to move into the ISO 40 2001 side of things, which is yes, yes, to both of us. And so the standards brand new for a lot of organizations, obviously you were at the bleeding edge from the certification body side of things. What are the top three misconceptions you see leaders have about it and what it covers and what it doesn't?
David Forman: Yeah. Near and Yeah, that's a good point. First of all, I think what we're seeing right now with kind of the rise of AIUC1 too, like we're seeing some of those gaps that are coming out. I'd say for 2001 it's a management system standard by definition and if you're unfamiliar with what a management system is for any listener, it's essentially a governance program and that's how you should view for 2001. It's a governance framework. I hate saying framework because it's really a scheme, but like it's a governance framework for like how you maintain and like can improve on as part of some sort of feedback loop like whatever AI things are affecting your organization. And you're familiar with this, Walter, but for others, like the stakeholder roles within ISO 400 2001 are really important too. When we think about am I a producer or developer? Am I a provider? Am I a user? Thinking about how you fit into the shared responsibility model of AI use cases with possibly a frontier model, a third party LLM. I think that's really important to understand too, to just kind of where your line is in terms of responsibility. Where I'll go further with this, if you asked me a year ago, I'd say, The kind of biggest pitfall we'd see in 40,000 initial certification clients was a lot like couldn't understand like or get their hands around what a system impact assessment was. They one didn't understand like, you know, how granular to get on like the definition of a system. Like some try to do it like governance program wide. Others would get down to a product level. Some would get down to a feature level. And then others also didn't know like how deep do you go into like a system impact assessment? If you're a deployer of some sort, like maybe you have like accuracy reporting to do to like be able to check for hallucinations in the model through different outputs or use cases. I'd say that's more of a problem of 2025. I think a lot of our customers have kind of like... found templates or found stuff that works like for them at this point. I've gotten more expertise on it. I've gotten more competent themselves. Now what we're seeing in 2026, kind of like for the surveillance lot of customers coming back around, the flavor of the day I've been noticing, and this sounds lame, but it's like change management. And what I mean by that is very few companies have the same kind of risk profile as OpenAI and Anthropic. Most of them are plugging into a third party LLM for some sort of gen AI application and being an AI provider. where we see issues in year two. is they went through a system impact assessment in year one on, I'll give an example, like ChatGBT, like 4.0, and now they're using 5.2 for OpenAI. ⁓ But they did an impact assessment at 5.0, didn't do one at 5.2. Like, what is considered a major change for them? Like, when are you reevaluating that underlying model or system card in terms of, is it still having the same safeguards you originally thought when you were white labeling essentially on your platform for end customers? Additionally, moving from 5.0 to 5.1, is that a major change or is that a minor change? mean, even OpenAI doesn't issue a new model card every time they have a new version update like that, a new model variant. If I go in, I'm looking for better use of my tokens or better capacity of an LLM in a moment, and I now want to use diverse providers, and I have anthropic and OpenAI now, or perplexity, something like that. Is that considered a new system impact assessment if it's just a new vendor coming into the scope or if the use case is the same? Could we all just kind of recycle that same impact assessment and I'll tell you a lot of organizations I think are kind of failing at like defining what is change management for them They don't understand what is major versus minor change in this context like they do for like pushing code of production and I think that's gonna be a little bit of a learning curve because I don't think we've even really defined it that well as an industry
Walter Haydock: I think change management is absolutely a huge issue that a lot of companies do not define well, especially when it comes to AI. And this is something that I'm helping our clients with right now is when a new version of GPT 5.4 comes out, then what do you do? And what we're doing right now is we're tracking, you know, the Vectara Hallucination Leaderboard, which is an open source data data set. You know, we're pushing updates as soon as the kind of UI based versions because they automatically change. And we're also tracking, you know, the risk of model drift is something that we need to stay on top of in our risk register. It's something we recommend to our customers because like you mentioned, things are moving fast and organizations haven't necessarily figured out how they're going to stay on top of it.
David Forman: I'll give one other kind of I'll say trend I'm noticing too. You would imagine like 2024, 2025, kind of the early adopters are going to be big tech essentially. And now we're starting to see this kind of come into like, you know, more everyday use cases as we call, but also more of these boring industries, right? Like manufacturing. And I had a call literally today with a manufacturer. I guess you could call him that. And I asked them about, they actually asked me about I support 2001, which is interesting. I didn't think the topic was going go that way. We were talking about 27,000 originally which makes way more sense for them and I was like, what do you want to know about 40 2001? And they said, well, we don't have any AI like, you features or things like, you know, from like a SaaS application standpoint, but we know we're using it. I was like, well, there's a stakeholder role for that. There's AI user. And, um, and they said, but we don't really have a policy around it. Our policy is just block all AI. Like, I'm like, oh my, that's an interesting strategy in 2026 to block all AI. And I said, all right, if that's your policy right now, do you think you're effectively doing it? And they said, we're doing it from like a DLP and like org like standpoint. Um, but what we're not doing is. we're not effectively doing it within TPRM. We're not effectively doing it with. you know, I'll say being able to monitor our own employees of data leakage. I'm like, that last part, double click on that. What do mean by that? And they said, we send out an anonymous survey and we found out that employees being that we don't have a company wide approved AI solution for LLMs and gen AI and like a chatbot. They are using their personal devices and putting in company information in those personal devices, you know, swearing on the Bible that they're not like putting any sensitive information in there. and getting their free chat GBT, I guess, mobile app to spit out an AI summary for them and then they're using that for their work. I said, that feels like a way bigger risk than just approving an AI solution for the company to use. I said, you guys just need to get on chat GBT team tomorrow. That's crazy. So when you think about companies that take this hard stance, being resistant to change and saying, ⁓ we're not gonna allow AI because we don't want any of our data being used for training of models, that's always the buzzword. uncertainty and doubt, FUD, that you're talking about is actually creating a new risk for you where employees are gonna find workarounds to that policy and they're gonna do something far more insecure. And I would say like that's kind of the trend we're at now, which is let's say big tech, they're early adopters, are they figured it out completely? Absolutely not, like still learning curve, but for those more antiquated industries that say we're just not gonna like pay attention to what's happening in the world of AI. I think they're creating these risks unknowingly with their own workforce that's possibly leaking, I'll say, sensitive information.
Walter Haydock: And I'm sure those employees are saying something like, I've worked for a manufacturing company in the Southwestern United States. And then opening eyes like, ⁓ look at this IP address. I wonder which firm this is. And they're training on the data because they're using the free version. So yeah, yeah. Yeah.
David Forman: Yep. ⁓ and it's on a free version of chat GBT, which you have no protections on. It's crazy.
Walter Haydock: Yeah. Yeah, I think ⁓ the, don't use AI is, an interesting stance. actually wrote an article on how there are multiple failure modes of that stance itself. There are multiple ways in which taking that approach can, can go wrong. So I definitely agree with you.
David Forman: Yeah. Well, I'll tell you this too, like from a third-party risk management standpoint, like show me, say you have a hundred suppliers. I guarantee you out of a hundred suppliers, over 90 of them had AI baked into something as their as a service model to you. Um, if not more, to be honest. And so if you're taking the stance that we're not using AI, like I would say your entire TBRM strategies screwed up at that point. But I also had somebody tell me at one point too, which I thought was interesting. They said, we don't struggle. I'll say flagging any of these AI vendors coming in to our like onboarded, like supplier program, whatever they said, we struggle with the existing ones. that have been embedded in our company for 10 years plus. They're on auto renewal schedules. Like the contract only gets re-reviewed once every five, 10 years because it's low spend. And they add an AI feature overnight. It's a little toggle. And there's five users in the 100,000 person company that use this tool on a daily basis. They're all in marketing and they see this little like new feature flag pop up on the app and they just hit it and say, yeah, I want to start getting AI summaries. And like just overnight now you have this supplier that was low risk now turn into high risk. per your policy of blocking all AI because they're summarizing all your marketing content. And I'd say that's a huge issue for TBRM teams that work off of any sort of vendor tiering model to do vendor due diligence reviews because they have to basically go re-tier everybody and they have to also be very, I'll say, current on what are those features and whether or not any of are AI enabled.
Walter Haydock: That's absolutely a huge challenge. And that's something that we are working with our customers on. We recently introduced a new feature on our end on the Stackware side, basically whenever we're capturing evidence for any sort of assessment, we do two things. One, we capture an archive.org version of the page. So it's like timestamped. Yeah. So we timestamp it. And then we pull a hash of the page as it is today when we're making the assessment.
David Forman: ⁓ yeah? ⁓ that's interesting. Yeah. Yeah.
Walter Haydock: And then when we go back, what happens is, first of all, we check the hash. If the hash is the same, then the page hasn't changed. So there's no, don't need to do anything. If the hash has changed, we send out an OpenAI API call to see what the change was compared to the previous data. If there's a change, then we flip that over. We've got an analyst who's doing human review of that type of information to make sure that the AI is getting it right. So yeah.
David Forman: Yeah, totally. Yeah. Wow. So is that page like, are you archiving the terms of use or something? What are you archiving? Yeah. Terms of use, privacy notices. Yeah. Those could all do it. Interesting. That's creative, Walter. I like that. That's very creative.
Walter Haydock: Yeah, that's one example. That's one example is like turn. Yeah. Yeah. Terms of service is a big, is a big one. Yeah. Yeah. Yeah. You know, and that is now part of our, our ISO 42001 AI management system is tracking that we're tracking, you know, rates of human override and, or confirmation.
David Forman: Tell your auditor that's a key strength, because I haven't seen that. That sounds really good. Yeah. That's neat.
Walter Haydock: Yeah, using AI to govern AI. Yeah. Yeah, that's the goal. The key thing is like the cost because, you know, just having a human expert like check everything is challenging. It takes a lot of time and ⁓ skill. really getting the AI up to the point where like it's not because it'll come it'll like nitpick things. It'll be like, ⁓ know, change's happening glad. I'm like, that's not it. We don't need to review that.
David Forman: Yep.
Walter Haydock: That's not that was not a material change. You know, don't don't do.
David Forman: I have a couple of tasks, this should probably be like a topic in itself, but like just basically how you're using it, like in your business and like personal life. But I have a couple of tasks that are set up right now where I monitor web pages for just like changes, like typically to like leadership teams and stuff. Um, and I tell like, don't email me unless there is a change. So like the task is running daily, but technically I'm not seeing a bunch of noise on unless there's actually any material change. But like, if I see like, you know, a company gets a new CEO or something, a new CSA, something more relevant to our industry. Um, like I'll. especially if I'm already connected to that person on LinkedIn, it'll basically tell me, go send them a message and graduate them or something so I'm more personal. But these use cases are just getting like, I like what I just heard from you, that's so creative. I think that's where it's one thing to have somebody that has access to the same tooling, but this is just another level of, again, synthesis and comprehension of understanding how you can apply something to actually make your management system like.
Walter Haydock: Mm-hmm. Yeah.
David Forman: that much better too in current. It's a form of continuous monitoring in all reality, which, ⁓ you know, talk about flaws of ISO standards. I hate the fact that they're like point in time audits, like once a year, like much rather have something more continuous monitoring. And I think that's where all these compliance schemes are going here in the future too, like trust and errors and service, but ⁓ you can make it better than what the scheme is itself, like what it says in the heart requirements. And that's what you're doing. That's pretty cool. Yeah.
Walter Haydock: Yeah, I mean, you know, at a minimum, you'd have to do an annual risk assessment. But like from a realistic perspective, you got to be moving faster.
David Forman: Yeah. You want it pretty active. That's a living document. Your risks are changing quickly. Yeah. Interesting.
Walter Haydock: Yeah. Yeah, yeah, definitely. Yeah, so on that note, you know, we kind of talked about some misconceptions and ⁓ have you seen some governance theater out there? Have you seen some companies that kind of are sprinkling some fairy dust on it, so to speak?
David Forman: Yeah, and so I'm in a competitor marketplace. I'm not going to name competitors by any means, but what I will say, and to be honest, I feel like it can happen to the best of us. It's interesting seeing these ISO 4001 certificates. I pulled it up before this call actually, and I was looking at the current IAF search, search market intelligence, like data analytics, which I'm sure you've seen screenshots in the past. But certification-wise, I have access to the back end of IAF search, search, and you can see how many globally accredited 4001 certificates there are today. There's a couple of search fields you can play around with, but how I have it filtered is showing 292 current 4001 certificates as of 24 hours ago that are uploaded to the database. Compare that to ISO 27000. which has been around for a couple decades now and the ISO forum even longer under British standard moniker, there is over 80,000 on IFS research. So we are like super, super early innings for 2001 right now. ⁓ Getting back to your kind of point around like some governance compliance theater. ⁓
Walter Haydock: ⁓ wow.
David Forman: There are some large names that have gotten 42,000 certified here early in 2025. And it's comical because like a week or two later after they got certified and did their big PR push. there was then another PR about them getting breached related to their AI features, discriminating, leaking information, whatever. And I'll put it this way. We talked about this earlier about 40-2009, like it's a governance framework in all reality. And I've been close to other breaches where there's been an ISO 27,000 certification, it's like two type two report in place and that company still gets breached. It doesn't mean that they weren't meeting the compliance or conformity scheme team, it means they had a hole that obviously wasn't proactively identified and ⁓ their management system for whatever reason was deficient. And if you understand these ISO management system standards well, versus I'll say how they maybe are marketed in the external marketplace, they are designed to be continuous improvement models, as we call it. ⁓ it doesn't mean just cause I got ISO 27,000 certified or 40,000 certified that I am perfectly secure. It's not even a safe harbor, ⁓ and under most regulation. ⁓ it's just means that I have a program in place to practically identify deficiencies and weaknesses and to address those. have top management commitment. have appropriate like roles and responsibilities set up. I have risk assessment to at least try to capture like enterprise level, like items related to that risk taxonomy. ⁓ so there's, think a lot of, ⁓ I'll say misnomer is out. there around like, hey, I get 27,000 certified, I am a secure organization. No, it means you have a information security management system, AKA governance program in place, and you guys are doing the right things in terms of monitoring information security vulnerabilities, but it doesn't necessarily mean that you are continuously being monitored, that you are meeting those SLAs. So. I always try to start with that. ⁓ The other theater, just to give you something that's a little bit more precise an example, I had a conversation on this earlier this week too. There was a client, well not client, prospect that reached out and we ultimately didn't move forward because they were trying to do something in my mind that was a little bit misrepresentative. They were trying to scope an ISO 42001 certificate at the time of application to something so narrow that it just wasn't representative of what that company does. The company is an AI native company. They literally say it in the company name. It's on a tagline underneath their logo on their website. You go to their website. It's literally part of the subheader that you see on your browser window. And they were scoping it down to this one AI feature out of, I'll say, more than 10 that they have that are available on their services page. And we're trying to say out of a, I think about 500 person scope that like five people weren't scoped to that because they were like scoping it down to like just like the product managers for that one feature. And I told them, said, look, like theoretically you can scope however you want for ISO. Like that's one of the, I'll say benefits, but also cons of the standard. ⁓ But as an auditor, I have to make sure that the scope one makes sense, but also isn't going to be misrepresented to an in reader of the report. And I said, my concern here is you are known for all these other things. it's not necessarily this thing. And I said, if you go out and do a PR after getting certified in 40 2001, you would have to have such precise language in that PR saying what was scoped in that I think it's just nearly impossible that you're gonna be able to get a consistent message out of your sales and marketing teams after the fact. I I see a lot of risk with this type of scope statement. And they said, well, we only want to do this piece because the other pieces we don't think are actually conforming to the standard yet. I was like, I was like, call me back when you, the other piece was born in the standard. said, because this little tiny carve out, like I'm all for like having a foundation to build off of. But I said, this is like a little bit misleading. And I, I'm not sure they love that conversation because I've heard through the grapevine. They've solicited some other auditors now, but it is theater in my opinion. Like you don't say stack aware for this very specific product. as I say, 40,000 certified, like colloquially, you're just verbally talking to somebody, say, Stackware is 40,000 certified, very normal. ⁓ However, like if you look at like use of marks and like how you're actually supposed to represent it, you typically just refer back to the certificate and you say, look for that for the precise detail in terms of what was in scope. And because there's kind of, say differences and discrepancies between those two statements, I don't feel comfortable certifying just like a little tiny carve out of a much larger organization that has a different reputation. But that's where a lot of theater is right now. People are trying to do the bare minimum to say they have a 42,000 certificate somewhere in their organization with the hope that somebody doesn't kind of go another layer deeper during procurement.
Walter Haydock: That's definitely an interesting observation. think that could cause some issues operationally too, if you're kind of in one meeting and you're like, well, are we talking about this product or this product? if we're in scope that we need to do this, if we're out of scope, we need to do that. So I think you could be harming yourself from a business perspective as well.
David Forman: Think about a vendor supplier like due diligence questionnaire you receive. It never says, is this XYZ product ISO 27001 certified? It says, is your company ISO 27001 certified? So at best, like if they're asking.
Walter Haydock: At best, at best. Usually I get like, are you ISO? And I have to, say, yes, yes, yes or no, yes or no. I'm like, yes, I guess. Right. Yeah. Yeah. And you gotta love those security questionnaires that really, really are, are, are focused on the nuance of things.
David Forman: So for that specific use case, that salesperson could probably guess because like, we have it somewhere in the company. Like, and I think it's misleading. Yeah. Well, it's comments like, are you ISO certified? And you say yes. And it's like, all right, cool. Now tell us about every control and ISO 27,000. You're like, what? You're re-liking me? Yeah.
Walter Haydock: That's aggressive. That's aggressive. ⁓ Yeah, yeah, I remember back in the day when, well, I I fill out security questionnaires now, but I was really doing a lot of an old job. And the best one I got was like, it was a completely locked Excel sheet. And there's only yes or no. And it was like, confirm that you have discovered no software vulnerabilities in your product in the past 18 months. And I was like, is this a test? to see if people are going to say yes. Because like, if anyone ever said yes, I'd be like, ⁓ you're either lying or you're not looking, both of which are very bad. Or, well, yeah, not look, I would consider not looking. Yeah, yeah, I would consider not looking to be incompetent.
David Forman: Yeah. We're incompetent. We have to deal with this ability and your vulnerability, something like that. There's like no like field like add like explanatory notes or anything like that. That's funny.
Walter Haydock: No, no is yes or no. And I was like, no, because obviously anyone who's ever run a vulnerability scan gets a Christmas tree the first time that they look at
David Forman: Thank Yeah, so then you did the no and you got 20 more questions added. That's what happened.
Walter Haydock: But the thing is, I've gotten like two follow-up questions to security questionnaires in my life. And yeah, go ahead.
David Forman: Yeah, that's funny. I, one of the things I push back on constantly, and I don't know how this is viewed by people, but I never accept right to audit clauses in any of my service agreements. I get audited by accreditation bodies for this exact purpose, but it kind of stinks as a certification body to be honest. Like I can't have an ISO 27,000 certificate or 40,000 certificate from my company. Like I'm not allowed to get certified as a certification body. I get accredited. How many procurement people know what ISO 17021 is? Very few. And they don't understand what goes into that and the fact that we're actually building a management system that has a quality system for that. I get buried in these supplier questionnaires and then I always reject the right to audit clause because I'm like, that's why you guys are in a accreditation audit every year. I said, it's not for you to audit me. I said, also, I'm your auditor. This is weird.
Walter Haydock: Yeah, I've actually used ISO 400001 as a way to negotiate a way right to audit from customers. Because I'm like, I am getting audited. I'll show you my certificate. Yeah. Yeah.
David Forman: From a write to audit? Any third party audit that's doing like information security adjacent something like that should be more effective than like you spending resources to write to audit us. Yeah.
Walter Haydock: And I've been through customer audits at previous companies and like, you know, you're starting at like, okay, this is JIRA. And then the auditor's like, what's JIRA? And you're like,
David Forman: I mean, it's typically, your point, think it's a more junior person typically performing those audits because it's not a fun job.
Walter Haydock: Yeah, yeah, yeah. Cool. Well, so moving on, ⁓ we talked about scope and yeah, so want to talk about continuous improvement because that's something we discussed a little bit. You know, when you're evaluating ⁓ AI systems, like you use the risk assessment to drive your application of NXA controls. Have you seen some companies apply those controls in a, know, especially impressive or innovative manner over time? they doing things that are kind of out of the box in a good way?
David Forman: Yeah, I'll put it this way. One of the things I was disappointed with when 42,001 was first published as final international standard, actually that's confusing neurology, not as FDIS, but as the international standard in December, 2023. There's 38 annex A controls, as you're aware. And I would say about a third of them are more or less redundant with the clauses. If you don't know how to apply them really, like, but. You could probably meet those control objectives or control descriptions by just having really robust like clause type like evidence as well. So I don't like the kind of duplicative nature of parts of Annex A. The parts of Annex A that I do like are like more like inventory based like SDLC type requirements, obviously TPRM, which comes up in the final like subdomain A10. And then anything around like more, I'll paraphrase here, but like transparency notices. So like, this is how we plan to use AI. Talking about that in not only contracts, but in just like general notices available to any like prospects. I think that's like more of the value of ISO 400 in my opinion is almost having a third party auditor come in there and say, all right, you have this like privacy notice equivalent that you're passing out to end customers. Are you actually doing that? And someone auditing to that like that design. So to answer your question short, the most mature companies I've seen so far with ISO 400001 and applying those controls is those controls have to be a starting point and only a starting point. They cannot be the end game. If you look at the standard for what it is, like it is, and the ISO standards this way, but it is built to be a scheme that you can conform to as a two person company, but also as a 200,000 person company. And in order for that to be one size fits all, you have to apply kind of the risk-based approach you're talking about there. Like it just doesn't make sense otherwise. So like what Amazon's going to do is going to look very different than what Stackware is going to do for their 40,2001 certification. And both are certified, congratulations. ⁓ But your management system is going to look largely different than each other. Not only because of your stakeholder role, but also because of just like the risk of plugging the type of company you are and the size of the company you are. With that being said, I always try to, I'll say tie any Annex A control development ⁓ to a bigger problem or objective or use case than just, want to be ISO 40000 certified. If that's your initial goal, that's fine. That's a good foundation. But for those controls to operate well and to develop and continuously improve well over time, they have to be tied back to a business objective. And so ⁓ one of the business objectives I'd say is probably the most common right now, like just kind of these early innings again for AI governance and just LLMs coming on the market and consumers actually using LLMs, not just businesses. is I think just, I keep harping on it, but transparency. So like the best companies out there are the ones, and this is totally an opinion, ⁓ are the ones that are being very forthcoming about how we utilize AI in our services, ⁓ what type of training and models we are doing, even if it's just training on like metadata, not necessarily the information you're putting in as a user into these tools. ⁓ And then trying to give consumers, similar to like privacy and data subject access request type ⁓ capabilities, trying to give them options in terms of how they want to interact and how they want their data to be stored, retained, or ⁓ utilized through these services as well. Those are the ones that I think are just like, they see the light in terms of where this is all going, not only with regulation, but also where consumer preference is. And my best customers are the ones that are very, I'll say, public with those AI use cases and how they're training models. I think that's important to be. And I think they're winning, the ones that are more transparent and more open about it than the ones that are trying to kind of operate, like saying, oh, we barely use AI in our services. think that's kind of theater, to be honest.
Walter Haydock: Yeah, think transparency is the best policy. So we're actually getting toward toward time. This has been a great discussion and would love to give you an opportunity at the end to plug whatever you'd like to mastermind your travel blog.
David Forman: I'm going to travel in. Yeah, no, Mastermind Assurance is our full name. You can find us at mastermindassurance.com. When you go to our web page, you'll see that we are very narrowly focused, just like this conversation was. We work with just a subset of ISO management system standards, the ones that we believe are the most important to today's SaaS companies and other as a service models. That is ISO 27001 for information security, ISO 27701 for data privacy. Of course, ISO 42001 for responsible use of AI as well as some extensions. I said 2017, 2017, 2018, CSA star certification, all kind of making up what I call the modern like CIA triad. So if you're familiar with like confidentiality, integrity, availability, which was I say was like InfoSec from 15, 20 years ago. I think today's CIA triad is kind of three pillars. You have this information security, privacy pillar, and then the third pillar is actually horizontal. It's this underlying kind of like infrastructure of AI that has influenced InfoSec and data privacy. And I just think we gotta be honest with ourselves, like we cannot have true data protection either for our own users or in customers without considering the risk with AI. So if you wanna talk more about that and you wanna be audited and possibly even certified to this very cool standard ISO 400001, please give us a call. Mashminesurance.com.
Walter Haydock: David, thank you so much for coming on and to our audience, thank you for tuning in. This has been the Deploy Security Podcast and we will see you next time.
David Forman: Thanks Walter.
