The rules that apply to you, by market
Four markets, and the regimes that sit around the guidance
ISO/IEC DIS 27045.2 is international guidance. The duties an organisation carries come from its own jurisdiction. This page names the frameworks in our library that matter to a big data estate in the United States, the European Union, the United Kingdom and Australia, in that order, and says where a regime is named but not held.
United States
The federal baseline a CISO is measured against, plus the AI risk framework the same estate will be asked about. The health rule is named because it is the one most often triggered by big data in a US estate.
NIST Cybersecurity Framework 2.0
The govern, identify, protect, detect, respond and recover functions are the language a US board already reads. The big data characteristics fit the identify and protect functions.
NIST AI Risk Management Framework 1.0
The voluntary AI risk framework a US organisation is most often asked to map to. It is the natural home for the clause 6.9 question about AI and LLMs.
Conditional: applies where the estate holds protected health information. It is named, not stated, because whether it applies depends on the data, not the platform.
European Union
The data protection baseline, the cyber risk directive that reaches many big data operators, and the data sharing regulation that governs reuse. Financial entities also fall under the digital operational resilience rules.
The baseline for any estate that processes personal data. The variety risk of re-identification is a GDPR question before it is a security question.
The cyber risk management duties that reach essential and important entities, including cloud and data services. Conditional on the entity's sector and size.
The rules for reusing protected data and for data intermediation. Relevant where the big data estate includes data the organisation did not collect itself.
United Kingdom
The UK data protection regime, and the cyber assessment framework used across regulated sectors. The EU regime is named separately and does not apply in the UK by itself.
The baseline for personal data in the UK estate, read with the Data Protection Act.
The Act that sits around the UK GDPR and supplies the exemptions and the enforcement structure.
UK NCSC Cyber Assessment Framework
The outcome-based framework used in regulated UK sectors. Conditional on the sector regulator.
Australia
The information security manual a Commonwealth and critical infrastructure reader is measured against, the privacy principles, and the regulator's own management framework. Financial entities also fall under APRA's operational risk standard.
Australian Information Security Manual
The control set most Australian security teams are assessed against. The big data platform controls map into its governance and monitoring domains.
The baseline for personal information, including the APP 11 security obligation and the notifiable data breach scheme.
OAIC Privacy Management Framework
The regulator's own framework for embedding privacy management, useful as the governance wrapper around the characteristic work.
APRA CPS 230 Operational Risk Management
Conditional: applies to APRA-regulated entities. The operational risk and service provider duties reach big data platforms run by third parties.
The control set the draft names
The draft's bibliography names ISO/IEC 27002:2022 as its control reference, and Annex A maps the big data characteristics to security and privacy controls. The annex itself is not public in the draft, so this page does not state its rows. The catalogue below is the held control set those controls come from, 93 control titles grouped by theme, so a reader can map a characteristic to a control family and check the mapping against the published annex when it exists.
Organizational controls (37 controls)
- Policies for information security
- Information security roles and responsibilities
- Segregation of duties
- Management responsibilities
- Contact with authorities
- Contact with special interest groups
- Threat intelligence
- Information security in project management
- Inventory of information and other associated assets
- Acceptable use of information and other associated assets
- Return of assets
- Classification of information
- Labelling of information
- Information transfer
- Access control
- Identity management
- Authentication information
- Access rights
- Information security in supplier relationships
- Addressing information security within supplier agreements
- Managing information security in the ICT supply chain
- Monitoring, review and change management of supplier services
- Information security for use of cloud services
- Information security incident management planning and preparation
- Assessment and decision on information security events
- Response to information security incidents
- Learning from information security incidents
- Collection of evidence
- Information security during disruption
- ICT readiness for business continuity
- Legal, statutory, regulatory and contractual requirements
- Intellectual property rights
- Protection of records
- Privacy and protection of PII
- Independent review of information security
- Compliance with policies, rules and standards for information security
- Documented operating procedures
People controls (8 controls)
- Screening
- Terms and conditions of employment
- Information security awareness, education and training
- Disciplinary process
- Responsibilities after termination or change of employment
- Confidentiality or non-disclosure agreements
- Remote working
- Information security event reporting
Physical controls (14 controls)
- Physical security perimeters
- Physical entry
- Securing offices, rooms and facilities
- Physical security monitoring
- Protecting against physical and environmental threats
- Working in secure areas
- Clear desk and clear screen
- Equipment siting and protection
- Security of assets off-premises
- Storage media
- Supporting utilities
- Cabling security
- Equipment maintenance
- Secure disposal or re-use of equipment
Technological controls (34 controls)
- User endpoint devices
- Privileged access rights
- Information access restriction
- Access to source code
- Secure authentication
- Capacity management
- Protection against malware
- Management of technical vulnerabilities
- Configuration management
- Information deletion
- Data masking
- Data leakage prevention
- Information backup
- Redundancy of information processing facilities
- Logging
- Monitoring activities
- Clock synchronization
- Use of privileged utility programs
- Installation of software on operational systems
- Networks security
- Security of network services
- Segregation of networks
- Web filtering
- Use of cryptography
- Secure development life cycle
- Application security requirements
- Secure system architecture and engineering principles
- Secure coding
- Security testing in development and acceptance
- Outsourced development
- Separation of development, test and production environments
- Change management
- Test information
- Protection of information systems during audit testing
Start with the market, then the activity, then the data
A framework belongs on this page if it governs the buyer's activity or the data the buyer holds. A federal or primary regime comes before a single-state one. A sector law comes before a general one where the buyer is in the sector. Where a market's regime is not in the library, the page names it and does not state it.
The guidance does not create a duty in any of these markets. It changes how the big data risk is assessed under duties that already exist, which is why the market list matters more than the standard's own status.