In this ultimate how to audit guide to ISO 27001 Annex A 5.33 Protection of Records, you will learn directly from an ISO 27001 Lead Auditor:
- 10 Key Audit Steps
- Verification Criteria
- Required Evidence
- The Pass / Fail Test
I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.
Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.
Table of contents
- 1. Record Retention and Disposal Schedule Verified
- 2. Physical Record Storage Security Confirmed
- 3. Digital Record Encryption and Confidentiality Validated
- 4. Record Integrity and Falsification Controls Verified
- 5. Personal Identifiable Information (PII) Alignment Confirmed
- 6. Secure Disposal of Expired Records Evidenced
- 7. Statutory and Regulatory Retention Alignment Verified
- 8. Record Access Control Lists (ACLs) Validated
- 9. Metadata and Audit Trail Integrity Confirmed
- 10. Record Redundancy and Recovery Testing Verified
Auditing ISO 27001 Annex A 5.33 is the critical verification of an organization’s record lifecycle management to ensure legal and operational evidence remains accessible. The Primary Implementation Requirement is a formal retention and disposal schedule, providing the Business Benefit of regulatory compliance and protected institutional knowledge.
1. Record Retention and Disposal Schedule Verified
Verification Criteria: A formalised schedule exists that categorises record types and defines specific retention periods based on statutory, regulatory, and business requirements.
Required Evidence: Approved Document Retention and Disposal Schedule (RDS) with version history and management sign-off.
Pass/Fail Test: If the organisation cannot produce a schedule that maps record types to specific legal or business retention durations, mark as Non-Compliant.
2. Physical Record Storage Security Confirmed
Verification Criteria: Physical records are stored in secure environments that protect against unauthorised access and environmental hazards (fire, flood, humidity).
Required Evidence: Physical access logs for archive rooms, fire suppression system certificates, and environmental monitoring logs.
Pass/Fail Test: If sensitive physical records are stored in an unlocked or unmonitored area lacking environmental protection, mark as Non-Compliant.
3. Digital Record Encryption and Confidentiality Validated
Verification Criteria: Records containing sensitive or classified information are protected with cryptographic controls during storage to prevent unauthorised disclosure.
Required Evidence: Technical configuration report showing AES-256 (or equivalent) encryption at rest for the primary document management system (DMS) or file servers.
Pass/Fail Test: If “Confidential” or “Secret” digital records are stored in clear-text on shared drives accessible to non-authorised personnel, mark as Non-Compliant.
