ISO 27001 A.5.33: Protection of records

Create a records management policy and classification scheme. Identify every type of record your organisation must maintain and the applicable retention requirements. Build a retention schedule covering the record type, the legal or regulatory basis for keeping it, minimum and maximum retention periods, storage location and format, access restrictions, and disposal method.

Choose appropriate storage for different record types. Electronic records belong in managed repositories with access controls, version control, and backup. Use records management systems that enforce retention policies and prevent premature deletion. For anything you need to keep long-term, think carefully about format longevity and plan for migration as technology changes.

Protect records from unauthorised modification. Set access controls that restrict who can create, modify, and delete records. Log all access and changes with audit trails. For critical records, consider write-once storage, digital signatures, or other integrity verification mechanisms. The goal: no one can alter a record without it being detected.

Back up records properly and include records storage in your business continuity plan with appropriate RTOs and RPOs. Keep off-site copies of critical records. For physical records, ensure proper storage conditions - climate control and fire suppression - and consider digitising them for preservation.

Set up secure disposal procedures for when retention periods expire. Use cross-cut shredding for physical records and cryptographic erasure or physical destruction for electronic media. Document every disposal: what was destroyed, when, by whom, and how. Get certificates of destruction where appropriate.

Audit your records management practices regularly. Check that retention schedules are followed, records are properly protected, and disposal happens securely and on time.