Validity-related threats and controls

Text not public. The public view of the draft withholds this unit. The page states its position, what it asks the reader to prepare and the evidence an auditor samples. It does not state the clause text.

What it says, in our words

Validity asks whether the data suits its intended use, on relevance, consistency, precision and correctness. It is new in the scope of this draft and it carries the distinction the document makes between accurate and fit for purpose: a record can be accurate and still incomplete, which puts its validity at risk. The public clause 5.2 adds that when the data used to train a model changes, the model can lose validity without anyone editing it.

What it means for an ISMS manager

Write the intended use down for the data set and the model, then test the data against it. Validity is the characteristic that gives an auditor a question with an answer: what is this data for, and what shows it is still fit for that purpose. Monitor the training data as a controlled input, not as history.

What an auditor samples

• The intended-use statement.
• the validity test and its date.
• the model monitoring record.
• the retraining trigger.

Evidence lines are the artefacts an auditor or a reviewer asks to see. They are named here so the work can be planned; they are not a certificate and they do not replace the official text.