Variety-related threats and controls

Text not public. The public view of the draft withholds this unit. The page states its position, what it asks the reader to prepare and the evidence an auditor samples. It does not state the clause text.

What it says, in our words

Variety covers many shapes at once: formats, logical models, timescales, meanings and sources. The public clause 5.2 adds the point that matters most to a privacy officer: correlating an anonymised data set with a public one can infer identity. It also notes that AI and LLM systems handle text, images and sensor data, which needs classification and protection that a table-level policy does not give.

What it means for an ISMS manager

Test the anonymisation claim by trying to re-identify a sample, and record the test. Then look at the unstructured stores, because variety is where classification usually stops. If the organisation cannot say which data set is sensitive without opening it, the control is not operating.

What an auditor samples

• The re-identification test and its result.
• the classification coverage by store.
• the handling rule for each format.

Evidence lines are the artefacts an auditor or a reviewer asks to see. They are named here so the work can be planned; they are not a certificate and they do not replace the official text.