Veracity-related threats and controls

Text not public. The public view of the draft withholds this unit. The page states its position, what it asks the reader to prepare and the evidence an auditor samples. It does not state the clause text.

What it says, in our words

Veracity is completeness and accuracy. The public clause 5.2 goes further than a dictionary would: it points at provenance and reliability of the source, the context of the data and how accurate it is for the analysis built on it. It says the risks can aggregate and magnify, and that unreliable AI-generated data leads to wrong decisions.

What it means for an ISMS manager

Veracity is the characteristic where the evidence is a data quality record rather than a control description. Ask for the metric, the threshold, the last breach of it and what happened. For AI-generated data, ask for the provenance record separately, because a model that cannot say where its data came from cannot support a claim of accuracy.

What an auditor samples

• The data quality metrics and thresholds.
• the incident record for a threshold breach.
• the provenance record for AI-generated data.

Evidence lines are the artefacts an auditor or a reviewer asks to see. They are named here so the work can be planned; they are not a certificate and they do not replace the official text.