Terms and definitions

Public text. This clause is public in the draft. The statement below is ours and the clause number is the citation; the official wording is the one to check against.

What it says, in our words

Twenty-two terms are defined for the document, drawn from the two normative references and from the document itself. They run from artificial intelligence system and asset through big data, data classification and data life cycle to validity, value, variability, variety, velocity, veracity, volatility, volume and vulnerability. Each entry names its source, and several are marked as modified from that source.

What it means for an ISMS manager

The terms that matter for the work are the ones this draft changed. Big data is defined by the characteristics that require a scalable architecture, which is why the scope and the risk lens are built on characteristics rather than on a size threshold. Data life cycle now runs from the first idea to discontinuation, which gives retention and deletion a place in the life cycle instead of leaving them outside it. Risk is the effect of uncertainty on objectives, so a big data risk is still an effect on an objective, not a data quality defect on its own. Read the definitions in this order: big data, data life cycle, risk, threat, vulnerability, then the eight characteristics. That order lets each later term rest on the one before it. The changed terms are listed with their old and new wording on the terms page.

What an auditor samples

• The glossary mapping, with the eight characteristic definitions quoted from the published edition once it exists.
• The risk register's term set, checked against the document's definitions.
• The training or briefing record that shows the risk team has seen the changed terms.

Evidence lines are the artefacts an auditor or a reviewer asks to see. They are named here so the work can be planned; they are not a certificate and they do not replace the official text.