Dated record and free checker
Big data risk guidance is one ballot from publication. The record is the work.
ISO/IEC DIS 27045.2 gives guidance on the security and privacy risks that big data brings, characteristic by characteristic, and it reached close of voting on 7 August 2026. This site records the public draft clause by clause, the changes since the first draft, the evidence an auditor will ask for, and a free check that tells you whether it applies to your estate and what to do before your next audit.
Read from the real rules, not invented. Every answer ISO 27045 Revision Checker gives points to the official rule behind it, so you can check any line yourself.
Read from the real rules26 units behind it14 changes checked
Run the free checkRead the record
No account, no email, no upload. The six answers stay in your browser. The check is computed from the record on this site and states the clause it used.
Your result will appear here. Six answers on the free check produce an applicability line, a preparation date and three actions. It starts blank and says scope incomplete until you answer.
What the document is, and where it stands
ISO/IEC DIS 27045.2 is a Draft International Standard in the ISO/IEC 27000 family. Its scope gives guidance on managing the risks and threats that arise across the big data life cycle from volume, velocity, variety, variability, volatility, veracity, validity and value. It applies to every organisation that develops or uses big data systems, whatever its type, size or purpose, and it covers big data used in the design and implementation of AI systems.
The public record shows stage 40.60, close of voting, reached on 7 August 2026. The draft is 26 pages and the official edition is sold by ISO at 67 Swiss francs. Clause 2 makes ISO/IEC 27005:2022 and ISO/IEC 22989:2022 normative references, so the risk process and the AI vocabulary come from those two documents rather than from this one.
Publication is estimated for 15 September 2027. That is our arithmetic from the stage sequence, not an ISO announcement, and the page that carries it says so. Read the dated record.
The second draft is not a tidy-up of the first
Fourteen changes are visible between the public text of the first draft and this one. Validity is added to the scope, so the characteristics go from seven to eight. ISO/IEC 22989:2022 becomes a normative reference. Nine definitions are rewritten, and one of them fixes a defect: the first draft defined veracity with the wording of vulnerability.
The change table states each row in our own words, with the clause, what the earlier draft said, what this one says, and what to do about it. It is the page a consultant can use before a client meeting, and it is free.
Eight characteristics, eight questions for the estate
Clause 5.2 describes each characteristic and how it affects security. The pages below take each one, state the risk in plain words, and name the check an auditor will make and the evidence to keep. Veracity and validity are kept apart, because the draft keeps them apart and the difference changes the question.
Every unit of the document, and what is public
The draft has 26 units: the numbered clauses, their subclauses, and Annex A. The public view carries the table of contents, the foreword, the introduction, clauses 1, 2, 3.1, 3.2 and 5. Clauses 4, 6 and 7 and Annex A are withheld, so their pages state the unit's position and what to prepare, and do not state text that is not public.
6 units carry public text, 17 carry a title only and 3 are group headings. The record says which is which on every page.
Does it apply to you, and what do you do before the audit?
Six closed questions. No upload, no account, no email. The result is an applicability line with the clause behind it, a preparation date, the characteristics to test first, and three dated actions. It does not score compliance and it does not certify.
The check starts blank. An unanswered question returns scope incomplete, never a pass, because the honest answer to an incomplete picture is that the picture is incomplete.
The buyer's fill-in document, not a summary
The USD 799 kit is the obligation register for all 26 units, the 126-item evidence list by characteristic, the dated plan working back from the estimate, and the 14-row change table, as PDF, CSV and XLSX. It is built so a reader can fill in the estate column and hand it to an auditor or a board.
The five free specimen rows show the shape without an account. The kit arrives by one click to checkout, with no sign-in form before the payment page.
What the change watch sends
USD 49 a month. An email when the stage, the dates, the public text or the record changes, with the diff that changed it. The watch is for the months between close of voting and publication, when a briefing built on this record has to know that the document moved.
It does not watch your own risk register, your audit dates or your supplier list. It watches the record this site publishes, re-checked against the official sources.
The regimes that sit around the guidance
The document is international guidance. The duties an organisation carries come from its own jurisdiction, so the rules page names the frameworks in our library that matter to a big data estate in the United States, the European Union, the United Kingdom and Australia, in that order, with a section per market. Where a regime is named but not held, the page says so.
Read from the real rules, not invented. Every answer ISO 27045 Revision Checker gives points to the official rule behind it, so you can check any line yourself.
Read from the real rules26 units behind it14 changes checkedCheck any line yourself
The rules this is built from
- ISO/IEC DIS 27045.2 26 units, the public scope, terms and clause 5, stage 40.60 framework page
- ISO/IEC 27002:2022 93 control titles, used for the control catalogue the draft names framework page
Nothing here is guessed while you wait. Each requirement is written from the text and points to the exact clause it came from, and where the public draft withholds a clause, the page says so and does not state it.