A focused plan can help an organization prepare for customer questions or an audit. Ninety days is a planning framework, not a promise of certification or a deadline that suits every organization.
First month: understand current use
Inventory tools and use cases, including trials and browser extensions. Identify data boundaries and the people responsible in IT, product, and legal teams. Prioritize the uses that could have the greatest effect on customers or operations.
Second month: record decisions
For each significant tool or use, record its purpose, supplier, information involved, risk assessment, approval, and review date. Agree how changes and exceptions will be handled.
Third month: test the process
Collect examples of approvals, logs, reviews, and incident handling. Check whether people can follow the agreed process. Map the work to relevant ISO 42001 and ISO 27001 requirements, then plan the remaining gaps according to the scope and readiness of the organization.