ISO 27001 A.5.33: Keep Records Protected and Usable

What A.5.33 requires in practice

Control A.5.33 requires records to be safeguarded against being lost, destroyed, falsified, accessed without permission or released without permission. Records here means the information that evidences activities and decisions, from contracts and financial entries to audit trails and training attendance.

In practice the control asks the organisation to know which records matter, where they are kept and what protection each needs. That protection must address both loss and tampering, and it must allow the record to remain usable and trustworthy for as long as it is needed. Retention periods and handling often come from laws and contracts. The standard does not specify a records system; a clear record owner and a simple retention and protection rule per record type is one practical method.

Identify the record and the context needed to understand it

A record may be a document, transaction entry, dataset or other captured information. Determine which version or collection constitutes the authoritative record and what context is necessary to interpret it. A file without its approval history, identifier or relationship to a transaction may be incomplete for its intended purpose.

Assign ownership for relevant record categories. The owner should understand why they are retained, who needs access and how long they must remain usable. Storage administration can be delegated, but someone must still make the business decisions about retention, retrieval and authorised disposition.

Do not assume that every working copy needs identical treatment. Distinguish authoritative records from convenience copies where appropriate, while ensuring that deletion of a copy will not inadvertently remove the only remaining evidence. The distinction should be understandable to staff using shared drives, applications and paper files.

Protect integrity without preventing legitimate correction

Records sometimes need authorised correction or annotation. Define how that can occur without disguising the original event or losing the history needed for trust. The appropriate method depends on the record and obligations; a blanket prohibition on all change can be as impractical as unrestricted editing.

Restrict access and release according to need. A record may be required for a long period without needing to remain visible to every former project participant. Consider how access changes when work ends, ownership changes or information is archived.

Why protecting records matters to the business

Records are your proof. When a client disputes an invoice, a regulator asks for evidence or an auditor wants to see that a control operated, the answer depends on records being complete, authentic and available. Records that were lost, altered or seen by the wrong people turn a manageable question into a serious problem. Protection that is too tight can be a problem as well, since people cannot find what they need. Well-managed records save time, defend the organisation in disputes and show that its management system produces reliable information.

How to implement A.5.33

Start with the records that carry the most consequence and widen from there. One approach is shown below. A common mistake is to treat all records alike. Focus first on records whose loss or alteration would hurt most, such as contracts, financial entries, security logs and client deliverables. Involve the people who create and use them, since they know where copies really live. Make sure the protection chosen does not make legitimate access impractical, and check occasionally that an old record can still be opened and relied on.

1. List the main types of record the organisation creates and relies on.
2. Assign an owner to each type.
3. Identify legal and contractual rules on keeping and releasing them.
4. Decide storage, access and backup arrangements that protect against loss and alteration.
5. Apply controls so that changes are traceable and unauthorised release is prevented.
6. Make sure records remain readable as formats and systems change.
7. Review and dispose of records securely once retention ends.

Illustrative manufacturing example: a readable file loses its meaning

Illustrative BPO example: archived recordings retain broad access

A hypothetical BPO operation archives call recordings after a client campaign ends. The archive remains accessible to the full former campaign team because permissions were copied from the active workspace. Retention has been addressed, but access no longer reflects current need.

The owner establishes an authorised retrieval process and adjusts archive access. A sample retrieval confirms that appropriate staff can obtain a needed recording while unrelated users cannot. The organisation protects confidentiality without making legitimate access so difficult that staff create uncontrolled local copies.

Plan retrieval across technology changes

Determine how quickly required records must be retrieved and in what form. A storage arrangement that takes weeks to search may be unsuitable for the obligation or business purpose involved. Test retrieval using representative records, including older formats and records held by external providers.

Consider dependencies such as encryption keys, applications and media condition. An encrypted archive is unavailable if the necessary key or supported recovery method is lost. Plan preservation or migration before technology becomes obsolete, and protect supporting information with suitable controls.

Make retention and disposal decisions reliable

A retention schedule is a useful way to express record categories, periods and disposition rules, but its structure is an implementation choice. Identify the trigger from which a period runs and how exceptions or preservation needs are authorised. An ambiguous trigger can lead to inconsistent disposal even when everyone uses the same number of years.

When the authorised retention need ends, arrange appropriate disposition rather than keeping everything indefinitely by default. Check relevant holds and other obligations before disposal. Connect deletion or destruction with information deletion and suitable physical-media handling.

Evidence and common failure modes