Control A.5.33Protection of records
Records must be protected from loss, destruction, falsification, unauthorised access and unauthorised release.
Records are the subset of information the organisation must be able to produce and rely on later — financial records, personnel records, audit trails, contracts, and the records the ISMS itself is required to retain.
The control lists five threats, and they pull in different directions. Protection against loss and destruction argues for copies and long retention; protection against unauthorised access and release argues for fewer copies and disposal at the end of the retention period. Falsification adds integrity, which is why A.8.15’s logging and A.8.17’s clock synchronisation matter to records that may be relied on as evidence.
The requirement that is usually underdone is disposal. Retention schedules are written and not executed, so records accumulate past their period — which converts a compliance obligation into a standing exposure, and makes the organisation’s answer to a data subject or a regulator harder than it needed to be.
How to put this in place
Records that are lost, altered or kept forever each cause trouble. A retention schedule and protected storage show the organisation controls its records.
- List the record types you must keep, such as financial, contractual, personnel and legal.
- Set a retention period and legal basis for each, drawing on the A.5.31 register, and do not keep personal data longer than needed.
- Store records where they cannot be silently altered.
- Restrict who can edit or delete them.
- Delete records when the period ends and keep proof.
Evidence an auditor usually looks for: the retention schedule, storage settings such as retention locks and access, and evidence of deletion at the end of retention.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.