The record ยท stage 40.60 Close of voting
ISO/IEC DIS 27045.2, at close of voting
The official record on 21 October 2026 shows a Draft International Standard, edition 1, 26 pages, at stage 40.60. The ISO stage feed dates the stage to 7 August 2026. There is no published edition yet, and ISO has announced no publication date.
The fields the official record states
| Designation | ISO/IEC DIS 27045.2, Edition 1 |
|---|---|
| Title | Information security, cybersecurity and privacy protection. Big data security and privacy. Guidelines for managing big data risks |
| Status | Under development, stage 40.60 Close of voting |
| Stage reached | 7 August 2026 |
| Ballot | Draft International Standard enquiry, close of voting |
| Pages | 26 |
| Price | 67 Swiss francs from ISO |
| Committee | ISO/IEC JTC 1/SC 27 |
| ICS | 35.030, 35.240.01 |
| Publication estimate | 15 September 2027 our estimate, not an ISO date |
Why the estimate says September 2027, and why it is ours
Our estimate, not an ISO date. The record shows stage 40.60 reached on 7 August 2026. The remaining stages in ISO's sequence are the approval stage, the proof circulation, the vote on the proof and then publication. For a 26-page guidance document that sequence usually takes twelve to fourteen months from close of voting. Counting from 7 August 2026 puts the middle of that range at 15 September 2027. ISO has published no date for this document.
Treat the estimate as a planning date, not a deadline. It moves if the ballot returns comments that need a second enquiry, and it moves again if an approval vote fails. The record is re-checked and the site's own refresh script fails loudly when any fact behind the estimate changes.
The ISO abstract describes the subject in its own way: guidance on the threats that arise during the big data life cycle from the characteristics that are unique to big data. ISO's abstract says the document guides the reader through the threats that arise across the big life cycle of a big data system, from the characteristics that set it apart. The scope in the public draft carries all eight and extends the guidance to big data used in the design and rollout of AI systems.
What the document is, and what it is not
It is
- Guidance on managing the security and privacy risks that big data characteristics add to an ordinary information security risk assessment.
- Applicable to every organisation that develops or uses big data systems, whatever its type, size or purpose (clause 1).
- A companion to ISO/IEC 27005:2022 for the risk process and to ISO/IEC 22989:2022 for the AI vocabulary (clause 2).
- A structured way to pair each big data characteristic with the threats it brings and the controls that answer them (clause 6, by its title and the public clause 5).
It is not
- Not certifiable. It is guidance, and a certificate is still issued against ISO/IEC 27001.
- Not published. It is a Draft International Standard at close of voting, so the text can still change before publication.
- Not a replacement for ISO/IEC 27005:2022, ISO/IEC 27002:2022 or the organisation's own risk method.
- Not legal advice, and not a statement that an organisation complies with anything.
Where the document goes from here
| Stage | Name | What happens | Date |
|---|---|---|---|
| 40.60 | Close of voting | The enquiry ballot has closed and the comments are being resolved. This is where the record stands now. | 2026-08-07 |
| 40.92 | Full report circulated | The ballot report goes to the members who voted. | after 40.60 |
| 40.93 | Full report circulated | The committee decides whether the draft proceeds or needs another enquiry. | after 40.92 |
| 50.00 | Approval | The draft is submitted for the approval vote. | estimate only |
| 50.20 | Proof sent to secretariat | The proof is prepared and checked. | estimate only |
| 50.60 | Close of voting on proof | The approval vote on the proof closes. | estimate only |
| 60.00 | International Standard published | The published edition replaces the draft. | estimate only |
The dates after 40.60 are not published. They are left as estimates so the table cannot be mistaken for a schedule from ISO.
Work backwards from the estimate, not from a deadline
| When | Do | Keep |
|---|---|---|
| Now | Write the applicability note and name the big data systems it covers. | A one-page decision with the systems, the data types and the owner. |
| Now | Read the changes between the first and second draft before briefing anyone. | The change table, with the clause reference for each row. |
| Before the audit | Add the eight characteristics to the risk assessment method as a lens on likelihood and impact. | The revised method, the risk entries it produced and the reviewer's sign-off. |
| Before the board paper | Decide whether to prepare now or wait, and record the cost of each. | The decision paper and the date it was taken. |
| When | Do | Keep |
|---|---|---|
| On publication | Re-read clauses 4, 6, 7 and Annex A, which the public draft does not carry. | The published text, with the clause-by-clause read recorded against the record. |
| On publication | Check every definition and the scope against the published wording. | A marked copy of the record showing what moved. |
| First audit after publication | Sample the evidence list for each characteristic in scope. | The sampling sheet and the evidence the auditor was shown. |
| Annual review | Confirm the guidance still sits where the ISMS expects it, beside 27005 and 27002. | The review note in the management review minutes. |
Where this comes from
- ISO record for ISO/IEC DIS 27045.2 (88970). Status, stage 40.60, close of voting, edition 1, 26 pages, CHF 67, committee, ICS codes and the abstract. Retrieved 21 October 2026.
- ISO stage feed for 88970. The feed states that the document reached stage 40.60 on 2026-08-07. Retrieved 21 October 2026.
- Public view of ISO/IEC DIS 27045.2 in the ISO Online Browsing Platform. The table of contents, foreword, introduction, clause 1, clause 2, clause 3.1, clause 3.2 and clause 5 are public. Clauses 4, 6, 7 and Annex A are not. Retrieved 21 October 2026.
- Public view of the first draft, ISO/IEC DIS 27045. Used only for the change table. The first draft is superseded by the .2 draft. Retrieved 21 October 2026.