Answer ยท What the document is, in one paragraph.
What is ISO/IEC 27045?
ISO/IEC 27045 is a guidance standard on managing the security and privacy risks that big data brings. It works through the characteristics that make big data different, pairs each with the threats it creates, and points to controls. It is a draft at close of voting, not a published standard.
What the document covers
The scope gives guidance on the risks and threats that arise across the big data life cycle from volume and velocity, variety and variability, volatility and veracity, validity and value. It applies to every organisation that develops or uses big data systems, and it covers big data used in the design and rollout of AI systems. The document is 26 pages in draft.
Where it sits in the family
It is a companion to ISO/IEC 27005:2022, which supplies the risk process, and to ISO/IEC 22989:2022, which supplies the AI vocabulary. It does not replace ISO/IEC 27002:2022 or the organisation's own control set, and it does not replace the ISMS requirements of ISO/IEC 27001.
What it is not
It is not certifiable, it is not published, and it creates no transition deadline. It is also not legal advice: the privacy duties an organisation carries come from law and contract, not from this guidance.
Why it matters now
The draft reached close of voting on 7 August 2026. That is the last stage before the approval sequence and publication, so the window to prepare is the window before the text is fixed. An organisation that waits for publication will read it under audit pressure.
What to do first
Write the applicability note, list the big data systems it covers, and put the eight characteristics on the risk workshop agenda. The free check on this site produces the first draft of that note from six answers.
The sources and the clauses
The record behind this answer is on the publication record, with the ISO page, the stage feed and the public draft linked. The clause map is on the clause page, and the change table on the changes page.
Where this comes from
- ISO record for ISO/IEC DIS 27045.2 (88970). Status, stage 40.60, close of voting, edition 1, 26 pages, CHF 67, committee, ICS codes and the abstract. Retrieved 21 October 2026.
- ISO stage feed for 88970. The feed states that the document reached stage 40.60 on 2026-08-07. Retrieved 21 October 2026.
- Public view of ISO/IEC DIS 27045.2 in the ISO Online Browsing Platform. The table of contents, foreword, introduction, clause 1, clause 2, clause 3.1, clause 3.2 and clause 5 are public. Clauses 4, 6, 7 and Annex A are not. Retrieved 21 October 2026.