Volume · term 3.1.21 · risk in 6.1
Volume, and the risk it brings
How much data there is, measured by what it costs to compute, store and manage while it is processed. It is a workload question as much as a size question.
What the draft means by volume
How much data there is, measured by what it costs to compute, store and manage while it is processed. It is a workload question as much as a size question. The definition sits in clause 3.1.21 and the risk it brings is described in the public clause 5.2, with the paired threats and controls in clause 6.1.
The risk the draft names
Layers of storage and transmission, different networks and protocols, and a mix that makes normalisation hard. AI systems can produce data faster than the estate can trace or store it.
What to check in the estate
Map every copy and every layer before counting controls. Ask where normalisation happens and what record it leaves. Test whether a backup or replica sits outside the retention rule. Measure the growth rate against the capacity plan, not against last year's headline volume.
What an auditor samples for volume
- Layer and copy inventory
- Capacity plan with growth rate
- Normalisation record
- Retention and deletion evidence
These are the artefacts that show the characteristic is managed, not only named. Name them before the audit, because an evidence list written afterwards is a description of what happened, not a control.
The definition in this draft
The definition was rewritten. The first draft measured size and amount; this draft measures the extent that affects computation, storage and their management during processing.
The clause behind the pairing is clause 6.1, and the definition is term 3.1.21. The wider change table is on the changes page.
Where this comes from
- Public view of ISO/IEC DIS 27045.2 in the ISO Online Browsing Platform. The table of contents, foreword, introduction, clause 1, clause 2, clause 3.1, clause 3.2 and clause 5 are public. Clauses 4, 6, 7 and Annex A are not. Retrieved 21 October 2026.
- Public view of the first draft, ISO/IEC DIS 27045. Used only for the change table. The first draft is superseded by the .2 draft. Retrieved 21 October 2026.