ISO/IEC DIS 27045.2 Draft International Standard Stage 40.60 Close of voting, 7 August 2026 Publication estimate 15 September 2027 Kit USD 799 or watch USD 49 a month
ISO 27045 Revision CheckerBig data risk, read from the draft

The characteristics ยท eight pages

The eight Vs, as the draft uses them

Clause 5.2 describes the characteristics commonly called the Vs of big data and explains how each one affects security. This section gives each characteristic a page: the definition, the risk in plain words, the check an auditor will make, the evidence to keep and what changed in the definition between drafts.

The pages do not add requirements. They take the public text and put it in the order a risk workshop needs, so the characteristic can be tested against the estate rather than admired in a glossary.

01The pages

One page per characteristic

Each page states the definition, the risk the draft names, the check an auditor makes and the evidence to keep, and it cites clause 5.2 and the paired clause 6 subclause.

3.1.21VolumeHow much data there is, measured by what it costs to compute, store and manage while it is processed. It is a workload question as much as a size question.Read the characteristic3.1.18VelocityHow fast data moves through the estate: created, then transmitted, stored, analysed and visualised. The rate covers the whole life cycle, not only the moment of creation.Read the characteristic3.1.17VarietyHow many shapes the data takes: formats, logical models, timescales, meanings and sources. Unstructured and semi-structured data sit here alongside tables.Read the characteristic3.1.16VariabilityThe data keeps its name while its speed, shape, meaning or quality moves under it. A schema, a unit or a source can change without the data set being renamed.Read the characteristic3.1.20VolatilityHow quickly the data goes stale, which is why a data set stops suiting the current analysis and why an audit trail can lose its integrity.Read the characteristic3.1.19VeracityHow complete and accurate the data is, read together with where it came from and what it is being used to support. Provenance is part of the answer.Read the characteristic3.1.14ValidityWhether the data is fit for the purpose it is put to, judged on relevance, consistency, precision and correctness. Accurate is not the same as valid: a record can be right and still incomplete.Read the characteristic3.1.15ValueWhat the organisation learns from finding patterns in the data, and the business benefit that follows. The document calls it the most important characteristic.Read the characteristic
02The confusion to avoid

Veracity is not validity, and volatility is not retention

The draft keeps four ideas apart and a workshop will merge them if it is not stopped. Veracity is completeness and accuracy. Validity is whether the data is fit for the intended use, and a record can be accurate and still invalid because it is incomplete. Volatility is the rate of change of the data over time. Retention is a decision that follows from volatility, not a synonym for it.

The first draft made two of these mistakes itself: it gave veracity the vulnerability wording, and it described volatility as a retention question. This draft corrects both, which is why the change table spends four rows on definitions.