When ISO 27001:2022 added control A.8.11 (“data masking”) and broadened the language around data classification, most implementers registered it as a small update. The bigger shift was quieter and more consequential: the standard started treating training data as a first-class information asset.
This matters because most organizations with AI systems have training data that was never treated as an information asset at all. It was treated as a technical artifact, owned by data science, governed informally, and classified inconsistently, if at all.
## The common belief
The default assumption is that ISO 27001 covers production data, customer data, and employee data. Training data, if considered at all, sits in a grey zone: it is not operational data, it is not exactly intellectual property, and it does not feel like the kind of asset that belongs in the 27001 register.
That assumption fails once the organization’s models become commercially significant. Training data becomes the ingredient that determines model behavior, and therefore the ingredient whose quality, provenance, and security determine product quality and product liability.
## What 27001:2022 actually expects
Several 2022 Annex A controls apply directly to training data, even though the standard does not single it out by name. The applicable controls include:
– A.5.12 (classification of information): training datasets require classification just like any other information asset, with implications for access, handling, and retention.
– A.5.13 (labeling of information): classification labels must propagate through training pipelines, not stop at the operational database.
– A.8.10 (information deletion): when data subjects exercise deletion rights, the path from operational stores to training sets is rarely documented, and the standard increasingly expects it to be.
– A.8.11 (data masking): specifically addresses techniques like masking, pseudonymization, and differential privacy that are directly relevant to training data governance.
– A.5.34 (privacy and protection of PII): extends to PII that ends up in training data, not just PII in operational databases.
– A.8.12 (data leakage prevention): explicitly includes training data as a category where leakage risk must be assessed.
Taken together, these controls produce a 27001 expectation that training data is classified, labeled, subject to deletion, subject to masking where applicable, and monitored for leakage. In practice, most organizations cannot produce evidence for any of these against their training data.
> The information asset inventory in most ISMS documents ends at the production database. The training data sitting in object storage, powering the models, is often off the map entirely.
>
## Where the real problem lives
Three concrete gaps show up repeatedly in audits.
### 1. Provenance is undocumented
Most training datasets are assembled from a mix of internal data, licensed datasets, scraped public data, and synthetic data. The provenance of each chunk is rarely recorded in a way that the ISMS can audit. When a copyright claim, a data subject request, or a regulatory inquiry arrives, the organization cannot answer what came from where.
### 2. Classification does not propagate
A customer record in the production database may be classified as “Confidential” with controls attached. The same record, extracted into a training dataset in Parquet format on object storage, often loses its classification entirely. The controls stop at the pipeline boundary.
### 3. Deletion does not reach training sets
When a data subject exercises the right to erasure under GDPR or equivalent regimes, most organizations delete from operational databases but do not delete from training datasets. The model trained on the data continues to exist. Whether that constitutes non-compliance is a live legal question, and increasingly regulators are taking the position that it does.
## Reframing the question
The question most ISMS implementations ask is “What information assets do we hold?” The question AI-operating organizations need to ask is “What information assets do we hold, and how many of them exist only in training datasets that have not been classified, labeled, or mapped to deletion workflows?”
The answer is often surprising. Training datasets can contain structured customer data, unstructured internal documents, scraped web content, and third-party licensed data, all blended into one asset whose classification profile is effectively the highest-risk subset but whose handling is the loosest in the organization.
## The structural shift
Data governance has spent the past decade moving from static classification to lifecycle classification: the same data has different risk profiles at rest, in transit, in production, in analytics, and now in training. 27001:2022 codifies this lifecycle view with the new attribute system and the consolidated control set.
AI systems push the lifecycle one step further. Training data is not just another stage; it is a stage where data loses its original context and picks up new risks: model memorization, membership inference, copyright entanglement, privacy reconstruction attacks. Each of these is a failure mode that the information asset framing either handles directly (if the asset has been registered) or misses entirely.
## What this means for your organization
Add training datasets to your information asset inventory. This is usually a one-time mapping exercise, revealing between 10 and 100 significant datasets that were not formally registered. The mapping produces the foundation for applying 27001:2022 controls consistently.
Extend classification rules to training pipelines. When data moves from production to training, classification should propagate automatically, not be reset. This often requires metadata changes in data pipelines and ETL processes.
Build deletion traceability before regulators require it. Map the path from operational deletion request to training dataset impact. In most organizations, this map does not exist. Building it is cheaper now than under regulatory timelines.
> An ISMS that does not know what is in its training data is not wrong. It is incomplete. And the incompleteness is exactly where the next audit finding lives.
>
—
Ready to close the training-data gap in your ISMS?
📩 [[email protected]](mailto:[email protected]) · 🌐 [zertia.ai](http://zertia.ai)
–
