Key takeaways
- Protect records from loss, destruction, falsification and unauthorised access.
- Records prove what happened and are often legally required.
- Start here: identify which records you need to keep and for how long.
Purpose
Protect records from loss, destruction, falsification and unauthorised access.
Requirement
Requirement summaryRecords shall be protected from loss, destruction, falsification, unauthorized access and unauthorized release.
Why it matters
Records prove what happened and are often legally required. They must be protected from loss, change and unauthorised access.
How to implement
- Identify which records you need to keep and for how long.
- Store them with appropriate access controls and backups.
- Protect integrity, for example write-once storage for audit logs.
- Dispose of records securely at the end of retention.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.33. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your records retention policy: how long each type of record is kept and how it is protected.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.33 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Examples of records kept for the right time and protected from loss or changes.
- Records of old information being securely deleted when no longer needed.
Things you should be able to show or explain
- Be able to show where key records are stored.
How much to show: Five or so record types.
Common mistakes
- Everything kept forever.
- Records deleted too early.
- Keeping everything forever, increasing exposure.
- Records stored where anyone can edit them.
- Tip: Define retention periods per record type.
Policies & documents to have
- Document control procedure
- Access Control Policy
- Data Management Policy
FAQ
Is A.5.33 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.33?
Be ready to explain how the control works in your organisation and to provide things like: Your records retention policy: how long each type of record is kept and how it is protected…