What changed ยท DIS 27045 to DIS 27045.2
14 rows, one per visible change
This table compares the public text of the first draft, ISO/IEC DIS 27045, with the public text of ISO/IEC DIS 27045.2. Both are read from the ISO Online Browsing Platform on 21 October 2026. Each row states the clause, the earlier position, the current position, why it matters and what to do. The wording is ours; the clause is the citation.
Read it as a diff, not as a new document
The single most important row is the veracity definition. The first draft gave veracity the wording of vulnerability, which is a defect rather than a drafting choice. Anyone who built a glossary from the first draft has the wrong definition, and veracity is the characteristic most often used in a data quality argument.
The scope row matters next. Validity is added, so the characteristics go from seven to eight. A briefing built on seven is incomplete, and the missing characteristic is the one that asks whether the data is fit for the purpose rather than merely accurate.
Scope Clause 1
Validity in scope
The first draft
The first draft listed seven: volume and velocity, variety and variability, volatility, veracity and value.
This draft
This draft lists eight. Validity sits between veracity and value, and the scope sentence carries it into the subject of the guidance.
Why it matters
An organisation that briefed its risk team on seven characteristics briefed an incomplete list. Validity is also the characteristic that carries the accurate-versus-fit-for-purpose distinction, so leaving it out changes how the data quality question is asked.
What to do
Add validity to the risk worksheet and to the glossary note. Check any training slide that still says seven.
Normative reference Clause 2
Ai reference
The first draft
ISO/IEC 27005:2022 was the only normative reference. ISO/IEC 22989:2022 was cited in the terms.
This draft
ISO/IEC 22989:2022 is a normative reference alongside ISO/IEC 27005:2022.
Why it matters
The AI vocabulary is now part of the required reading, not an explanatory footnote. A reference list that still names only 27005 is out of date against this draft.
What to do
Update the controlled reference list and the risk method's bibliography.
Title Clause 5
Clause 5 renamed
The first draft
The clause was titled Big data.
This draft
The clause is titled Introduction to big data.
Why it matters
The rename signals that the clause is background for the threat and risk clauses. A briefing that cited clause 5 as the substance of the standard cited a background clause.
What to do
Correct any briefing or supplier note that used the old title.
Title Clause Annex A
Annex a renamed
The first draft
The annex mapped big data Vs to security and privacy controls.
This draft
The annex maps big data characteristics to security and privacy controls.
Why it matters
The wording moved from the informal shorthand to the term the document defines and uses. Anyone searching for the old title will not find the annex under it.
What to do
Update the cross-reference in the control mapping and in any training material.
Definition Clause 3.1.19
Veracity corrected
The first draft
The first draft's veracity entry repeated the vulnerability definition word for word: a weakness that can be exploited in an asset or in a control.
This draft
Veracity is the completeness and accuracy of the data, sourced to ISO/IEC 20546:2019.
Why it matters
This is a defect in the first draft, corrected here. Anyone who built a definition sheet from the first draft has the wrong definition of veracity, and it is the characteristic most often used in a data quality argument.
What to do
Replace the veracity definition in the glossary and check every document that quoted the old one. Tell whoever owns the data quality metric.
Definition Clause 3.1.20
Volatility redefined
The first draft
Volatility was treated as a retention question, a matter of how long the data is valid and how long to keep it.
This draft
Volatility is the rate at which the data changes over time. Retention is treated as one of its consequences in the public clause 5.2.
Why it matters
The change separates two ideas that the first draft merged. A team that treats volatility as a retention rule will not test the audit trail against the pace of change.
What to do
Rewrite the volatility line in the risk method and add the audit trail test to the evidence list.
Definition Clause 3.1.18
Velocity redefined
The first draft
Velocity was the speed at which data is generated, produced, created or refreshed.
This draft
Velocity is how fast data moves through creation, transmission, storage, analysis and visualisation.
Why it matters
The definition now covers the whole life cycle, which is what makes the streaming control question relevant at analysis and visualisation as well as at ingestion.
What to do
Extend the velocity evidence to the analysis and reporting path, not only the stream.
Definition Clause 3.1.21
Volume redefined
The first draft
Volume meant how large the data is, and how much of it an organisation manages and analyses.
This draft
Volume is how much data matters for compute and storage capacity, and for managing both while the data is processed.
Why it matters
The definition shifts the measure from size to workload and management. A petabyte count no longer answers the question on its own.
What to do
Replace the volume metric in the capacity plan with a workload measure.
Definition Clause 3.1.17 and 3.1.16
Variety variability
The first draft
Variety meant the diversity of data types and sources. Variability meant the changing nature of the data the organisation seeks to capture, manage and analyse.
This draft
Variety covers many shapes at once: formats, logical models, timescales, meanings and sources. Variability is movement in the speed, shape, meaning or quality of the data.
Why it matters
Both definitions now name what changes, which makes them testable. The old wording could describe almost any data estate.
What to do
Use the new wording in the characteristic sheet and in the data quality tests.
Definition Clause 3.1.7
Data life cycle
The first draft
Data life cycle meant the stages by which a data asset is managed, sourced to ISO/IEC 55000:2014.
This draft
Data life cycle is the stages of data use from idea conception to discontinuation, sourced to ISO/IEC 5259-1:2024.
Why it matters
The new definition starts earlier and ends at discontinuation, which gives creation and deletion a place in the life cycle and ties the guidance to the AI data quality family.
What to do
Check the retention and deletion steps are inside the life cycle in the method.
Definition Clause 3.1.9
Llm definition
The first draft
An LLM was a machine learning model with many parameters, trained on a large text corpus to model natural language, sourced to an amendment.
This draft
An LLM is a machine learning model with many parameters that encodes how natural language works and supports a range of language processing tasks, defined in the document.
Why it matters
The definition is now self-contained and wider: it covers tasks, not only representation. The source note no longer points at an amendment.
What to do
Update the AI inventory's definition and the model register.
Definition Clause 3.1.11 and 3.1.10
Risk privacy sources
The first draft
Risk came from ISO/IEC 27005:2022. Privacy policy came from ISO/IEC 29100:2011.
This draft
Risk comes from ISO 31000 and is marked as modified. Privacy policy comes from ISO/IEC 29100:2024.
Why it matters
The risk definition now rests on the general risk vocabulary rather than the security guidance, and the privacy definition is a current edition. Both change the citation, not the meaning, for most readers.
What to do
Correct the source citations in the glossary and in the board paper footnote.
Reference list Clause Bibliography
Bibliography
The first draft
The first draft listed eight sources, including ISO/IEC 27005:2022.
This draft
This draft lists twelve. It adds ISO/IEC 5259-1:2024, ISO/IEC 27000, ISO/IEC 27035-3:2020 and ISO/IEC 55000:2024, and drops 27005 from the bibliography because it is now a normative reference.
Why it matters
The additions show where the committee looked when it rewrote the definitions: data quality, vocabulary, incident response and asset management.
What to do
Align the reading list for the risk team with the new bibliography.
Editorial Clause Foreword
Foreword
The first draft
The foreword named the technical committee in the older wording and carried the shorter patent paragraph.
This draft
The foreword names the joint technical committee in the current wording and carries the expanded patent paragraph.
Why it matters
Editorial only. It changes no obligation and no definition, and it is listed so the reader who compares the two documents knows it was checked.
What to do
No action beyond the record.
The parts that stayed put
Three things did not move and it is worth saying so. The applicable audience did not narrow: every organisation that develops or uses big data systems is still covered. The AI scope sentence still names the design and rollout of AI systems. The nine subclauses of clause 6 still carry the eight characteristics and the AI and LLM question. The structure is stable across the two drafts, which is why the change table can be read as a diff rather than as a new document.
The bibliography did change, and one entry moved rather than disappeared: ISO/IEC 27005:2022 leaves the bibliography and becomes a normative reference. That is a promotion, not a removal.
Where this comes from
- Public view of ISO/IEC DIS 27045.2 in the ISO Online Browsing Platform. The table of contents, foreword, introduction, clause 1, clause 2, clause 3.1, clause 3.2 and clause 5 are public. Clauses 4, 6, 7 and Annex A are not. Retrieved 21 October 2026.
- Public view of the first draft, ISO/IEC DIS 27045. Used only for the change table. The first draft is superseded by the .2 draft. Retrieved 21 October 2026.
- ISO record for ISO/IEC DIS 27045.2 (88970). Status, stage 40.60, close of voting, edition 1, 26 pages, CHF 67, committee, ICS codes and the abstract. Retrieved 21 October 2026.