Volatility-related threats and controls

Text not public. The public view of the draft withholds this unit. The page states its position, what it asks the reader to prepare and the evidence an auditor samples. It does not state the clause text.

What it says, in our words

Volatility is how quickly the data changes. The public clause 5.2 ties it to the point at which a data set stops suiting the analysis it was gathered for, to the integrity of audit trails, and to how long the data remains valid, and how long to keep it. The threat is a control that keeps data because it is cheap to keep, and an audit trail whose timestamps no longer line up with the decision it is meant to support.

What it means for an ISMS manager

Reconcile the retention schedule with the audit trail. If the trail is kept longer than the data it explains, or shorter, one of the two is wrong. The published clause will pair this with controls; the preparation is to know which record the auditor will ask for.

What an auditor samples

• The retention schedule.
• the audit trail configuration.
• the reconciliation note.
• the deletion evidence for a completed period.

Evidence lines are the artefacts an auditor or a reviewer asks to see. They are named here so the work can be planned; they are not a certificate and they do not replace the official text.