Big data risk management process

Group heading. This unit groups subclauses and carries no text of its own. The pages it groups are linked below.

What it says, in our words

The public view of the draft carries the title of clause 7 and the titles of its five subclauses, not their text. The five titles are establishing the risk management framework, risk identification, risk analysis and evaluation, risk treatment, and risk monitoring and review. Together they follow the same process an ISMS manager already runs under ISO/IEC 27005:2022, which clause 2 makes a normative reference. This page does not state what the subclauses say.

What it means for an ISMS manager

Treat clause 7 as the hinge between the guidance and the certificate. The committee did not write a new risk method; it placed the big data work inside the method the ISMS already has. That means the preparation is not a new process document. It is a lens applied at each step, with a record at each step that an auditor can sample. The five headings are a useful checklist for the evidence as well: the framework, the identified risks, the analysis that rated them, the treatment with an owner, and the review that tested whether they are still the risks that were assessed. If any of the five has no artefact for the big data estate, that is the gap to report. When the published text arrives, read the five subclauses against the artefacts and record what the document adds to each.

What this heading groups

• 7.1 Establishing risk management framework
• 7.2 Risk identification
• 7.3 Risk analysis and evaluation
• 7.4 Risk treatment
• 7.5 Risk monitoring and review

What an auditor samples

• The risk method, with the big data characteristic lens written into it.
• The identified risk entries for the big data systems, each with its characteristic.
• The analysis, the rating and the criteria used to decide acceptability.
• The treatment record with an owner and a date, and the review that followed.

Evidence lines are the artefacts an auditor or a reviewer asks to see. They are named here so the work can be planned; they are not a certificate and they do not replace the official text.