ISO/IEC DIS 27045.2 Draft International Standard Stage 40.60 Close of voting, 7 August 2026 Publication estimate 15 September 2027 Kit USD 799 or watch USD 49 a month
ISO 27045 Revision CheckerBig data risk, read from the draft

Clause 1 · Public

Scope

The scope states what the document is for and who it is for. It gives guidance on managing the risks and navigating the threats that arise across the life cycle of a big data system, from the characteristics that make it different: volume and velocity, variety and variability, volatility and veracit

1The unit

Public text. This clause is public in the draft. The statement below is ours and the clause number is the citation; the official wording is the one to check against.

What it says, in our words

The scope states what the document is for and who it is for. It gives guidance on managing the risks and navigating the threats that arise across the life cycle of a big data system, from the characteristics that make it different: volume and velocity, variety and variability, volatility and veracity, validity and value. It says the guidance applies when big data is used in the design and rollout of AI systems. It closes by saying that every organisation which develops or uses big data systems is covered, whatever its type, size or purpose.

What it means for an ISMS manager

Read the scope as an applicability test, because that is what it is. The document does not ask whether an organisation is large, regulated or in a particular sector. It asks whether the organisation develops or uses big data systems. If the answer is yes, the guidance is written for you, and the practical question becomes which of the eight characteristics your systems actually show. The second thing the scope settles is that this is not a technology-only document. It names AI systems in the same sentence as the big data life cycle, so a data platform that feeds a model is inside the guidance, and so is a model that produces data the platform then holds. Write the applicability note against the scope's own words, not against a vendor's summary.

What changed in this unit

The characteristics this covers

VolumeHow much data there is, measured by what it costs to compute, store and manage while it is processed. It is a workload question as much as a size question.VelocityHow fast data moves through the estate: created, then transmitted, stored, analysed and visualised. The rate covers the whole life cycle, not only the moment of creation.VarietyHow many shapes the data takes: formats, logical models, timescales, meanings and sources. Unstructured and semi-structured data sit here alongside tables.VariabilityThe data keeps its name while its speed, shape, meaning or quality moves under it. A schema, a unit or a source can change without the data set being renamed.VolatilityHow quickly the data goes stale, which is why a data set stops suiting the current analysis and why an audit trail can lose its integrity.VeracityHow complete and accurate the data is, read together with where it came from and what it is being used to support. Provenance is part of the answer.ValidityWhether the data is fit for the purpose it is put to, judged on relevance, consistency, precision and correctness. Accurate is not the same as valid: a record can be right and still incomplete.ValueWhat the organisation learns from finding patterns in the data, and the business benefit that follows. The document calls it the most important characteristic.

What an auditor samples

  • A one-page applicability note naming each big data system, the business owner and the date.
  • The data inventory extract that shows those systems, with the data types and volumes.
  • The risk assessment or method that already covers them, so the guidance can attach to it.
  • The board or risk committee minute that records the decision to prepare now or wait.

Evidence lines are the artefacts an auditor or a reviewer asks to see. They are named here so the work can be planned; they are not a certificate and they do not replace the official text.

·Related

Cross-references in the draft

Clause 1 cross-refers to 3.1.4, 5.2, 6, 7. Public text. The scope in this draft lists eight characteristics and adds validity to the seven the first draft carried.

Back to the clause map What changed

·Source

Where this comes from

Buy the kit, USD 799See the five free rows