Value-related threats and controls

Text not public. The public view of the draft withholds this unit. The page states its position, what it asks the reader to prepare and the evidence an auditor samples. It does not state the clause text.

What it says, in our words

Value is the insight that comes from discovery and pattern recognition. The public clause 5.2 calls it the most important characteristic and also the one that attracts attack: insight is worth stealing, and it is worth manipulating if a decision depends on it. The threat is not only disclosure. It is also the quiet corruption of the data behind a valuable conclusion.

What it means for an ISMS manager

Treat the derived data set as an asset in its own right. It needs a classification, an owner and an access rule that is not inherited by accident from the raw data. Ask who can change the data behind a board metric, and what would show that it had been changed.

What an auditor samples

• The asset entry for the derived data set.
• its classification and owner.
• the access rule.
• the integrity check behind the metric.

Evidence lines are the artefacts an auditor or a reviewer asks to see. They are named here so the work can be planned; they are not a certificate and they do not replace the official text.