Big data characteristics

Public text. This clause is public in the draft. The statement below is ours and the clause number is the citation; the official wording is the one to check against.

What it says, in our words

The clause describes the characteristics commonly called the Vs of big data and explains, for each one, how it affects security. Volume brings dimensionality and layers of storage and transmission. Velocity brings the faster flow of data being created, stored, analysed and visualised. Variety brings structured, semi-structured and unstructured data, and with it the risk of re-identifying people by correlation. Variability brings faster movement in speed, shape, meaning and quality. Volatility brings the loss of relevance over time and the damage to audit trails. Veracity brings provenance, context and accuracy. Validity brings the question of whether the data is right for the purpose, which is not the same as accurate. Value brings attention, because insight is worth stealing or manipulating.

What it means for an ISMS manager

Eight characteristics is a workable agenda for a risk workshop if you take them one at a time. For each, ask three questions: does this show in our estate, what threat does it bring here, and what evidence would show we manage it. The clause gives you the middle question; the first and third are yours. Two pairs are routinely confused and the document separates them. Veracity is completeness and accuracy; validity is whether the data is right for the intended use, and a record can be accurate and still invalid because it is incomplete. Volatility is the rate of change of the data over time; validity is what the data is fit for. Write both distinctions into the worksheet so the workshop does not merge them. Volume is the one that most often looks handled when it is not. The clause points at dimensionality and at the mix of layers, not only at size in terabytes.

The characteristics this covers

What an auditor samples

• A characteristic-by-characteristic sheet for the estate, with present, absent and reason.
• The threat named against each characteristic present, in the organisation's own words.
• The evidence that would be sampled for each, named before the audit rather than after.
• The workshop record showing the veracity and validity distinction was made.

Evidence lines are the artefacts an auditor or a reviewer asks to see. They are named here so the work can be planned; they are not a certificate and they do not replace the official text.