Protection of records

What the requirement asks

Records are to be safeguarded against being lost, destroyed, falsified, accessed without authorization or released without authorization. Purpose: meet legal, regulatory and contractual obligations and community or societal expectations about keeping records protected and available. Guidance: so records stay genuine, trustworthy, complete and usable as their business context and management needs evolve, issue guidelines on storing and handling records, chain of custody and disposal, including preventing tampering, aligned with the records management policy; and prepare a retention schedule naming records and how long each is kept. The storage and handling arrangements should identify records and their retention periods with regard to national or regional law and, where relevant, societal expectations, and allow proper destruction once a record is no longer needed. Protection of particular records takes account of their classification. Records are grouped into types (for example accounting, transaction, personnel, legal), each with its retention period and the physical or electronic media allowed. Storage systems are chosen so that records come back quickly enough and in a usable format. For electronic media, procedures keep records accessible and readable for the whole retention period despite technology change, and the keys and programs for encrypted archives or digital signatures are kept for as long as the records (8.24). Storage and handling follow media manufacturers' recommendations and allow for media deterioration. Other information: records evidence events, transactions or processes and are information assets in any form; metadata describing their context, content, structure and management is essential; law may fix retention periods and content; ISO 15489 covers records management. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Records protection covers integrity, availability and retention. The guidance asks for the record set, the retention rule, the storage and the disposal evidence.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep records handling guidelines covering storage, chain of custody, tamper prevention and disposal, aligned with the records management policy and one live sample together.

Evidence an assessor asks for

• Records managementRecords handling guidelines covering storage, chain of custody, tamper prevention and disposal, aligned with the records management policy
• Records managementA retention schedule listing record types, retention periods, legal basis and permitted storage media
• Records managementEvidence of controlled destruction at the end of retention periods
• Records managementProcedures and tests demonstrating that electronic records remain readable across format and technology changes
• Records managementRetention of cryptographic keys and software needed to read encrypted or signed archives for the full retention period
• Records managementRecords of media condition checks or migration to counter deterioration

The question an assessor will ask

An assessor will ask for records handling guidelines covering storage, chain of custody, tamper prevention and disposal, aligned with the records management policy, then trace it to the system it protects. For A.5.33 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• No retention schedule exists, so records are either kept forever or deleted early
• Encrypted archives cannot be opened because the keys were not retained
• Legacy formats can no longer be read and no migration was planned
• Records are held in systems that allow alteration without any audit trail

Before the next audit

Before the next audit, check one live sample for this gap: no retention schedule exists, so records are either kept forever or deleted early.