Topic-specific policies
ISO/IEC 27046

Search this site

ISMS templates

< Previous standard      ^ Up a level ^      Next standard >


ISO/IEC 27046 — Information technology — Big data security and privacy Implementation guidelines [DRAFT]



This document aims to analyze key challenges and risks of big data security and privacy, and propose guidelines for implementation of big data security and privacy in aspects of big data resources, and organizing, distributing, computing and destroying big data.
[Source: SC27 Standing Document 11 (2021)]


This standard is intended to help organizations implement the processes described in ISO/IEC 27045 in order to ensure the security and privacy of big data.


Scope and purpose

The standard will “address the key challenges and risks of big data security and privacy” by providing guidance on:

  • [Identifying and] evaluating big data security and privacy risks;
  • Implementing, [using, managing] and maintaining security and privacy controls [and other risk treatments?];
  • Validating and verifying big data security and privacy arrangements [to gain assurance].

The audiences include:

  • software and hardware providers constructing and securing big data frameworks;
  • “application operators” (users?);
  • big data providers and consumers;
  • “industry to improve robustness and efficiency at the ecosystem level” (??) and to improve compatibility and inter-operation while diversifying choices of security products and reducing redundancy.  [based on the 2nd Working Draft].

ISO/IEC 20547-4 “Information technology - Big data reference architecture - Part 4: Security and privacy” is cited as a normative (essential) reference.


Content of the standard



Status of the standard

The standard development project commenced in 2019.

It is currently at 4th Working Draft stage.

The standard was due to be published in 2023. However, a hiatus on the ISO/IEC 27045 project puts this standard and its schedule in doubt.


Personal comments

The currently-adopted definition of ‘big data’ in the draft standard does not (in my personal, rather jaundiced and cynical opinion) reflect its widespread use in the IT industry at present, mostly because of the vagueness of ‘extensive’ which is essentially synonymous with, and adds little clarity to, plain ‘big’.  ‘Big data’ is defined as:

“Extensive datasets - primarily in the characteristics of volume, variety, velocity, and/or variability - that require a scalable architecture for efficient storage, manipulation, and analysis. [Source: ISO/IEC 20546]”

Wikipedia is more helpful e.g.:

“Current usage of the term big data tends to refer to the use of predictive analytics, user behavior analytics, or certain other advanced data analytics methods that extract value from data, and seldom to a particular size of data set. "There is little doubt that the quantities of data now available are indeed large, but that's not the most relevant characteristic of this new data ecosystem." Analysis of data sets can find new correlations to "spot business trends, prevent diseases, combat crime and so on." Scientists, business executives, practitioners of medicine, advertising and governments alike regularly meet difficulties with large data-sets in areas including Internet searches, fintech, urban informatics, and business informatics. Scientists encounter limitations in e-Science work, including meteorology, genomics, connectomics, complex physics simulations, biology and environmental research.

For me, one of the defining characteristics of big data is that typical (these days mostly relational) database management systems struggle or are unable to cope with the complexity and dynamics/volatility of truly massive data sets. Beyond the limits of their scalability, conventional architectures experience constraints and failures, no matter how much raw CPU power is thrown at the problems. That implies the need for fundamentally different approaches and I rather suspect entails novel information risks and hence security/privacy controls. However, it remains to be seen what this standard will actually address in practice: this is cutting-edge stuff.

I’m not sure how this standard will differ from and add value to the existing standard ISO/IEC 20547-4:2020.

< Previous standard      ^ Up a level ^      Next standard >

Copyright © 2021 IsecT Ltd.