Variability · term 3.1.16 · risk in 6.4
Variability, and the risk it brings
The data keeps its name while its speed, shape, meaning or quality moves under it. A schema, a unit or a source can change without the data set being renamed.
What the draft means by variability
The data keeps its name while its speed, shape, meaning or quality moves under it. A schema, a unit or a source can change without the data set being renamed. The definition sits in clause 3.1.16 and the risk it brings is described in the public clause 5.2, with the paired threats and controls in clause 6.4.
The risk the draft names
A schema change that stops a masking rule matching, a semantic change that makes an old classification wrong, and a quality drop that makes a report misleading without making it fail.
What to check in the estate
Ask for the pipeline change log and the validation that runs before a schema is used. Name the person told when a source changes its semantics. Test a control against a changed schema, not only against the current one.
What an auditor samples for variability
- Pipeline change log
- Schema validation test
- Semantic change notification
- Control test against a changed schema
These are the artefacts that show the characteristic is managed, not only named. Name them before the audit, because an evidence list written afterwards is a description of what happened, not a control.
The definition in this draft
The definition changed from a general description of changing data to a list of the four things that change: rate, format or structure, semantics, quality.
The clause behind the pairing is clause 6.4, and the definition is term 3.1.16. The wider change table is on the changes page.
Where this comes from
- Public view of ISO/IEC DIS 27045.2 in the ISO Online Browsing Platform. The table of contents, foreword, introduction, clause 1, clause 2, clause 3.1, clause 3.2 and clause 5 are public. Clauses 4, 6, 7 and Annex A are not. Retrieved 21 October 2026.
- Public view of the first draft, ISO/IEC DIS 27045. Used only for the change table. The first draft is superseded by the .2 draft. Retrieved 21 October 2026.