Veracity · term 3.1.19 · risk in 6.6
Veracity, and the risk it brings
How complete and accurate the data is, read together with where it came from and what it is being used to support. Provenance is part of the answer.
What the draft means by veracity
How complete and accurate the data is, read together with where it came from and what it is being used to support. Provenance is part of the answer. The definition sits in clause 3.1.19 and the risk it brings is described in the public clause 5.2, with the paired threats and controls in clause 6.6.
The risk the draft names
Risks that aggregate and magnify, decisions built on data whose source is uncertain, and AI-generated data that is unreliable in a way the reader cannot see.
What to check in the estate
Ask for the quality metric, its threshold, the last breach and what happened. Ask for the provenance record separately for anything a model generated. Test a sample against the source system rather than against the dashboard.
What an auditor samples for veracity
- Quality metrics and thresholds
- Threshold breach record
- Provenance record for AI-generated data
- Sample reconciliation to source
These are the artefacts that show the characteristic is managed, not only named. Name them before the audit, because an evidence list written afterwards is a description of what happened, not a control.
The definition in this draft
The first draft's veracity entry repeated the vulnerability definition. This draft replaces it with a completeness and accuracy definition sourced to ISO/IEC 20546.
The clause behind the pairing is clause 6.6, and the definition is term 3.1.19. The wider change table is on the changes page.
Where this comes from
- Public view of ISO/IEC DIS 27045.2 in the ISO Online Browsing Platform. The table of contents, foreword, introduction, clause 1, clause 2, clause 3.1, clause 3.2 and clause 5 are public. Clauses 4, 6, 7 and Annex A are not. Retrieved 21 October 2026.
- Public view of the first draft, ISO/IEC DIS 27045. Used only for the change table. The first draft is superseded by the .2 draft. Retrieved 21 October 2026.