SECTION 11
11Alignment with international standards
SECTION 11
UCSMM is built to work with three international standards at once. ISO/IEC 27001 protects information and systems; ISO/IEC 42001 manages AI across its lifecycle; ISO 45003:2021 — guidance within ISO 45001:2018 — guides the protection of the psychological health and safety of the people who work with it.
Each standard governs its own domain. UCSMM is the cognitive layer that connects them : it measures the maturity of all three as one capability, in four dimensions, and tells the organisation which one to raise next.
FIGURE 10 — THREE STANDARDS, ONE COGNITIVE LAYER
ISO/IEC 27001
Information security
Protects data, systems and identities through an audited management system.
ISO/IEC 42001
AI management system
Governs AI policy, impact assessment, data and the system lifecycle.
ISO 45003
Psychological health & safety
Guides the protection of people from psychosocial risk: workload, role clarity, exposure to harmful events.
UCSMM — measures all three as one capability
TABLE 8 — UCSMM DIMENSIONS × ISO STANDARDS
| UCSMM | ISO/IEC 27001 | ISO/IEC 42001 | ISO 45003 |
|---|---|---|---|
| Cl. 5 Leadership · A.5.1 Policies · A.5.2 Roles Leadership, policy and named roles | A.2 AI policy · A.3 Internal organisation · A.5 Impact assessment AI policy, accountability and impact assessment | ||
| A.5.24–5.28 Incidents · A.5.29–5.30 Continuity Incident response and continuity | A.6 Lifecycle · A.10 Third parties Deployment, operation, rollback and suppliers | Harmful events Support after major incidents | |
| D3 Intelligent detection | A.5.7 Threat intelligence · A.8.16 Monitoring Threat intelligence and monitoring | A.7 Data for AI · A.6 Lifecycle monitoring Data quality, provenance and model monitoring | Workload Alert load per analyst as an indicator |
| UCSMM | ISO/IEC 27001 | ISO/IEC 42001 | ISO 45003 |
|---|---|---|---|
| D4 Adaptive management | Cl. 9 Evaluation · Cl. 10 Improvement · A.6.3 Awareness Measurement, improvement and training | Cl. 9–10 · A.4 Resources Review, improvement and competence | Participation Worker participation and training on manipulation |
Each standard answers “is it in place?” — UCSMM answers “how mature is it, and what comes next?”
Clause and control references follow ISO/IEC 27001:2022, ISO/IEC 42001:2023 and ISO 45003:2021.
UCSMM in one line
Four dimensions to build, five levels to climb, twenty questions to locate the organisation, three waves to move it — and one rule: it is only as strong as its weakest dimension.
Tip: use ← → to move between sections.