ISO 27001 A.5.33 - Protection of Records

Requirement

“Records shall be protected from loss, destruction, falsification, unauthorized access and unauthorized release.”

Plain-language meaning

The organization must protect required records for as long as they need to be retained, so they are not lost, destroyed, falsified, accessed without authorization, or released without authorization.

Why this matters

Records prove business activity, legal compliance, audit history, transactions, system activity, and operational decisions. If records are missing, altered, unreadable, or disclosed incorrectly, the organization may fail audits, lose legal defensibility, breach regulations, or be unable to reconstruct what happened.

Implementation guidance

1. Identify record types that must be retained, including financial records, legal records, audit logs, transaction logs, database records, customs/environmental records, operational procedures, and security records.
2. List required records in the asset or records inventory with owner, location, retention period, protection need, legal/regulatory/contractual source, and disposal rule.
3. Protect records from loss, destruction, falsification, unauthorized access, and unauthorized release through access control, backup, immutability where appropriate, encryption, logging, version control, and secure storage.
4. Perform documented inventory checks at least annually to confirm required records still exist and remain accessible.
5. Plan for long retention periods by checking media deterioration, obsolete formats, required software, readers, cryptographic keys, and ability to produce records through the end of retention.
6. Define secure disposal after retention expires, including approval, evidence, legal hold exceptions, and destruction method.
7. Check legal admissibility and integrity requirements when records are scanned, converted, encrypted, migrated, or stored electronically.

Audit guidance

Auditors should verify that required records are identified, retention requirements are known, storage and protection controls are defined, inventory accuracy is checked, and records remain accessible and intact through their retention period. They should pay special attention to electronic records, scanned records, encryption keys, media deterioration, and disposal controls.

Evidence examples

Strong evidence

• Records inventory lists record type, owner, location, retention period, legal/contractual source, protection requirement, and disposal rule.
• Annual documented inventory checks confirm required records still exist and are accessible.
• Access controls, backups, integrity protections, and logging protect records from loss, falsification, unauthorized access, and unauthorized release.
• Long-term records have format, software, reader, media, and cryptographic key availability considered.
• Scanned or electronic records have legal admissibility and integrity requirements reviewed where relevant.
• Secure disposal records show approved destruction after retention or documented legal hold.

Weak evidence

• Records are kept in shared folders without ownership or retention rules.
• Retention periods are guessed or copied from old practice without legal review.
• Electronic records are encrypted but key retention is not planned.
• Old media or file formats are retained but no one can read them.
• Inventory checks are informal or not documented.
• Disposal happens manually without approval or evidence.

Common failures

Exam traps

• A.5.33 protects records against loss, destruction, falsification, unauthorized access, and unauthorized release.
• Protection must last until the end of the retention period.
• Records should be in the asset or records inventory and checked at least annually.
• Long retention requires considering media deterioration, obsolete tools, software, readers, and cryptographic keys.
• Electronic or scanned records may require legal admissibility and integrity review.

Related controls and concepts

• A.5.31 Legal, Statutory, Regulatory and Contractual Requirements
• Information and Associated Asset Inventory
• Evidence Collection and Chain of Custody Log
• Internal Audit
• Management Review
• Risk Assessment
• Legal and Contractual Requirements Register

KB-ready summary

A.5.33 requires practical protection of legally or operationally important information. The audit question is whether the organization can show what must be protected, why, where it is, who owns it, how long it is retained, who can access it, and how protection remains effective over time.

Templates and checklists

• Records Retention and Protection Register
• Records Inventory Review Checklist
• A.5.33 Audit Checklist