Annex A. Mapping between big data characteristics and security and privacy controls

Text not public. The public view of the draft withholds this unit. The page states its position, what it asks the reader to prepare and the evidence an auditor samples. It does not state the clause text.

What it says, in our words

Annex A is the mapping table that pairs each characteristic with a control family. The public view carries its title and a note pointing to Table A.1 for the detail, not the table itself. The annex is informative, which matters: it guides the reader from a characteristic to a control set, it does not add a requirement. The title changed in this draft: the first draft used the Vs shorthand in its title.

What it means for an ISMS manager

Annex A is the page a consultant will photocopy into a client pack, so it is worth understanding what it is and what it is not. It is informative: it does not create an obligation and it does not replace the organisation's own control selection. Its practical use is as a starting point when a characteristic is present and the control owner does not recognise a relevant control. Build the left-hand side now. Take the eight characteristics and, for each, name the controls in your estate that already answer the public threat statement in clause 5.2. When the published annex arrives, the comparison is a diff against a grid you already have, not a new exercise. Do not reproduce the table before it is published, and do not describe rows you have not read. The record here will state the annex's published shape and its control set when the text is public, and the watch will say when that happens.

What an auditor samples

• The eight-characteristic grid with the organisation's own controls named.
• The control owner's confirmation for each row.
• The note recording that the annex is informative and creates no obligation.
• The published annex, added to the controlled library when it exists.

Evidence lines are the artefacts an auditor or a reviewer asks to see. They are named here so the work can be planned; they are not a certificate and they do not replace the official text.