Variety, and the risk it brings

What the draft means by variety

How many shapes the data takes: formats, logical models, timescales, meanings and sources. Unstructured and semi-structured data sit here alongside tables. The definition sits in clause 3.1.17 and the risk it brings is described in the public clause 5.2, with the paired threats and controls in clause 6.3.

The risk the draft names

Sensitive data that classification never reached, and re-identification by correlating an anonymised set with a public one. Text, images and sensor data need handling rules that a table policy does not give.

What to check in the estate

Try to re-identify a sample from every anonymised set and record the result. Measure classification coverage by store, not by record count. Confirm that each format has a handling rule and an owner. Ask whether the organisation can say a data set is sensitive without opening it.

What an auditor samples for variety

• Re-identification test and result
• Classification coverage by store
• Handling rule per format
• Source register

These are the artefacts that show the characteristic is managed, not only named. Name them before the audit, because an evidence list written afterwards is a description of what happened, not a control.

The definition in this draft

The definition was rewritten to name formats, logical models, timescales, meanings and sources, and to include the range of sources.

The clause behind the pairing is clause 6.3, and the definition is term 3.1.17. The wider change table is on the changes page.

Buy the kit, USD 799See the five free rows