Answer ยท Where the guidance touches the ISMS and where it does not.
Does ISO/IEC 27045 affect ISO/IEC 27001 certification?
Not directly. ISO/IEC 27045 is guidance and cannot be certified against. It reaches the certificate through the risk assessment: ISO/IEC 27001 requires the organisation to identify and treat information security risk, and this document is a lens on the big data part of that risk.
No transition, no certificate
A guidance document does not create a certification transition and does not change the certificate. There is no ISO/IEC 27045 auditor and no statement of conformity to it. Any supplier who offers certification against it is selling something that does not exist.
The route into the audit
ISO/IEC 27001 clause 6 requires risk identification, analysis, evaluation and treatment, and clause 9 requires review. The draft's clause 7 follows the same process. The auditor's question is not whether you used 27045, it is whether the big data risk in your estate was identified and treated.
What the auditor will sample
The applicability note, the characteristic sheet, the risk entries it produced, the treatment and its owner, and the evidence named for each characteristic. That is a short list and it is testable.
What to change in the Statement of Applicability
Add the big data lens to the method note, not to the list of controls. The SoA states which controls from Annex A of 27001 are applicable and why; the guidance helps the reasoning, it does not add a control set of its own.
What not to claim
Do not claim certification or compliance against the draft. Do not cite it as a legal requirement. Cite it as guidance the ISMS considered, with the date and the clause.
The sources and the clauses
The record behind this answer is on the publication record, with the ISO page, the stage feed and the public draft linked. The clause map is on the clause page, and the change table on the changes page.
Where this comes from
- ISO record for ISO/IEC DIS 27045.2 (88970). Status, stage 40.60, close of voting, edition 1, 26 pages, CHF 67, committee, ICS codes and the abstract. Retrieved 21 October 2026.
- ISO stage feed for 88970. The feed states that the document reached stage 40.60 on 2026-08-07. Retrieved 21 October 2026.
- Public view of ISO/IEC DIS 27045.2 in the ISO Online Browsing Platform. The table of contents, foreword, introduction, clause 1, clause 2, clause 3.1, clause 3.2 and clause 5 are public. Clauses 4, 6, 7 and Annex A are not. Retrieved 21 October 2026.