How should we prepare for ISO/IEC 27045?

Start with applicability, not with controls

The scope is broad and it is a yes-or-no test. Name the big data systems, the data types and the business owner. If the answer is yes, the guidance is in scope; the work is deciding which characteristics show, not whether the document applies.

Put the eight characteristics on the wall

The draft names eight: volume and velocity, variety and variability, volatility and veracity, validity and value. For each, write present, absent and the reason. Two pairs are routinely merged and should not be: veracity against validity, and volatility against retention.

Walk one risk end to end

Take the characteristic most present in the estate and walk it through identification, analysis, evaluation, treatment and review. If the walk ends with a row an auditor can sample, the preparation is real. If it ends with a paragraph, it is not.

Name the evidence before the audit

Each characteristic has an evidence type: layer and copy inventory for volume, measured detection time for velocity, a re-identification test for variety, a change log for variability, retention and audit trail reconciliation for volatility, quality metrics for veracity, an intended-use statement for validity, and the derived asset record for value.

Decide now or later, and write it down

Preparing now costs time before the text is fixed. Waiting costs the audit cycle after publication. Either decision is defensible if it is recorded with its reason and its review date.

The sources and the clauses

The record behind this answer is on the publication record, with the ISO page, the stage feed and the public draft linked. The clause map is on the clause page, and the change table on the changes page.

Run the free check Kit and watch