Defined terms ยท clause 3
Twenty-two terms, and the ones that moved
Clause 3.1 defines 22 terms, drawn from the two normative references and the document. Clause 3.2 defines 5 abbreviations. The definitions below are our statements of the public text; the defined term stays as the draft writes it because it is the reader's index.
15 of the 22 definitions changed between the first draft and this one. They are marked in the table. The table is the fastest way to see whether a glossary built on the earlier draft is still current.
Every term in clause 3.1
| Clause | Term | Definition in our words | Source named | Since draft 1 |
|---|---|---|---|---|
| 3.1.1 | AI system | An engineered system that produces content, forecasts, recommendations or decisions for objectives a human set. | ISO/IEC 22989:2022, 3.1.4, modified | Changed |
| 3.1.2 | Asset | Anything of value to a person, an organisation or a government. | ISO/IEC 27035-3:2020, 3.1 | Unchanged |
| 3.1.3 | Availability | The property of being accessible and usable on demand by an authorised entity. | ISO/IEC 27000, 3.4 | Unchanged |
| 3.1.4 | Big data | Data sets large and varied enough in volume, variety, velocity or variability to need a scalable architecture for storage, manipulation and analysis. | ISO/IEC 20546:2019, 3.1.2, modified | Changed |
| 3.1.5 | Confidentiality | The property that information is not disclosed to unauthorised people, entities or processes. | ISO/IEC 27000, 3.2 | Unchanged |
| 3.1.6 | Data classification | The process of sorting structured or unstructured data into categories by sensitivity and by the impact of unauthorised disclosure, change or loss. | This document | Unchanged |
| 3.1.7 | Data life cycle | The stages of data use from the first idea to discontinuation. | ISO/IEC 5259-1:2024, 3.1 | Changed |
| 3.1.8 | Integrity | The property of accuracy and completeness. | ISO/IEC 27000, 3.3 | Unchanged |
| 3.1.9 | Large language model | A machine learning model with many parameters that encodes how natural language works and supports a range of language processing tasks. | This document | Changed |
| 3.1.10 | Privacy policy | The overall intention, direction, rules and commitment of a PII controller for processing personal data in a given setting. | ISO/IEC 29100:2024, 3.14 | Changed |
| 3.1.11 | Risk | The effect of uncertainty on objectives. | ISO 31000, 3.1, modified | Changed |
| 3.1.12 | Security capability | How well an organisation can put security measures in place. | This document | Changed |
| 3.1.13 | Threat | A possible cause of a security incident that can damage a system or harm an organisation. | ISO/IEC 27005:2022, 3.1.9 | Unchanged |
| 3.1.14 | Validity | Whether the data is fit for the use intended, judged on relevance, consistency, precision and correctness. | This document | Changed |
| 3.1.15 | Value | The insight found in the data and the better performance it produces. | This document | Changed |
| 3.1.16 | Variability | Movement in the speed, shape, meaning or quality of the data sets. | ISO/IEC 20546:2019, 3.1.13 | Changed |
| 3.1.17 | Variety | How many shapes the data takes: formats, logical models, timescales, meanings and sources. | ISO/IEC 20546:2019, 3.1.14, modified | Changed |
| 3.1.18 | Velocity | How fast data moves through creation, transmission, storage, analysis and visualisation. | ISO/IEC 20546:2019, 3.1.15 | Changed |
| 3.1.19 | Veracity | How complete and accurate the data is. | ISO/IEC 20546:2019, 3.1.16 | Changed |
| 3.1.20 | Volatility | How quickly the data itself changes over time. | ISO/IEC 20546:2019, 3.1.17 | Changed |
| 3.1.21 | Volume | How much data there is that matters for computation, storage and their management during processing. | ISO/IEC 20546:2019, 3.1.18, modified | Changed |
| 3.1.22 | Vulnerability | A weakness that an attacker can use, in an asset or in a control, to cause a negative event. | ISO/IEC 27005:2022, 3.1.10 | Unchanged |
The abbreviated terms
| Code | Meaning |
|---|---|
| DPO | data protection officer |
| IAM | identity and access management |
| LLM | large language model |
| MPC | multi-party computation |
| PII | personally identifiable information |
Veracity and validity, side by side
Veracity is the completeness and accuracy of the data. Validity is the relevance, quality, consistency, precision and correctness of the data for the use intended. A data set can be complete and accurate and still be invalid, because it is the wrong data for the decision or because the model it trained has moved on since.
The distinction is not academic. It decides whether the evidence you keep is a data quality metric or an intended-use statement, and an auditor who knows the document will ask for the right one.
Where this comes from
- Public view of ISO/IEC DIS 27045.2 in the ISO Online Browsing Platform. The table of contents, foreword, introduction, clause 1, clause 2, clause 3.1, clause 3.2 and clause 5 are public. Clauses 4, 6, 7 and Annex A are not. Retrieved 21 October 2026.
- Public view of the first draft, ISO/IEC DIS 27045. Used only for the change table. The first draft is superseded by the .2 draft. Retrieved 21 October 2026.