Variability-related threats and controls

Text not public. The public view of the draft withholds this unit. The page states its position, what it asks the reader to prepare and the evidence an auditor samples. It does not state the clause text.

What it says, in our words

Variability is movement in speed, shape, meaning or quality. The public clause 5.2 lists exactly those four and calls the risk faster change. In practice it is the characteristic that breaks a control quietly: a schema change that stops a masking rule from matching, a semantic change that makes an old classification wrong, a quality drop that makes a report misleading without making it fail.

What it means for an ISMS manager

Ask for the change log of the pipeline and the control that validates a schema before it is used. Then ask who is told when a source changes its semantics. The answer should name a person and a test, not a ticket queue.

What an auditor samples

• The pipeline change log.
• the schema validation test.
• the notification record for a semantic change.

Evidence lines are the artefacts an auditor or a reviewer asks to see. They are named here so the work can be planned; they are not a certificate and they do not replace the official text.