ISO 27001 Protection Of Records
ISO 27001 Annex A 5.33, called Protection of Records, asks you to keep all your records safe. You must protect them from people trying to read them, change them, or destroy them without permission. This control makes sure you follow all legal, rule-based, and contract requirements, plus what society expects.
Table of contents
What is ISO 27001 Annex A 5.33?
ISO 27001 Annex A 5.33 Protection of Records is an ISO 27001 control that wants you to protect records in line with legal, regulatory, statutory and contractual requirements as well as societal and community expectations. It is about protecting records from unauthorised access, loss or destruction, tampering or falsification and unauthorised release and sharing.
What is the purpose of ISO 27001 Annex 5.33?
The purpose of ISO 27001 Annex A 5.33 Protection of Records is to ensure you comply with legal, statutory, regulatory and contractual requirements related to the protection and availability of records.
Organisations should have a clear understanding of their obligations when it comes to the protection of records and make sure that they adhere to those requirements.
What is the definition of ISO 27001 Annex 5.33?
The ISO 27001 standard defines ISO 27001 Annex A 5.33 Protection of Records as:
Records should be protected from loss, destruction, falsification, unauthorised access and unauthorised release.
ISO 27001:2022 Annex A 5.33
ISO 27001 Compliance: 100% Guaranteed
Do it Yourself ISO 27001
with live expert support.
How to implement ISO 27001 Annex 5.33
Decide what kinds of protection are included
The kinds of protection expected include protecting the authenticity, reliability, integrity and usability of records. You will consider this protection in the context of the business and its requirements and how that changes over time.
Decide what kind of records are included
Records is just another term for the data and information an organisation retains and/or uses to carry out its day to day business activities. It can include
- Individual events
- Transactions
- Work processes
- Activities
- Functions
You can manage any set of information as a record, irrespective of either its structure or its form.
Issue Guidelines
Guidelines on how you store, transfer and dispose of records will be issued.
Topic specific policy on records management
You are going to implement an ISO 27001 Documents and Records Policy.
Retention schedule
A retention schedule for records will be implemented that sets out how long you retain records.
Legislation
Where you operate and the legislation that applies to you as recorded in your ISO 27001 legal register and covered in ISO 27001 Annex A 5.31 Legal, regulatory, statutory and contractual requirements.
Record Destruction
You will implement procedures that destroy records in a safe and appropriate manner the moment they’re not needed and / or after the end of the retention period defined in the retention schedule.
Classification
Following your information classification and handling policy and your classification scheme you will apply that to records.
Retrieval times
You will make sure that any storage procedures and process include an acceptable timeframe for retrieval. These will also take into account and third party or external requests for records.
Encryption
Where encryption is implemented as a control to mitigate risk you will, of course, ensure that they keys to decrypt are available. Consider the guidance in ISO27001 Annex A 8.24 Use of Cryptography.
Manufacture Guidelines
You will follow the guidelines from the suppliers and manufacturers for storage and handling and you will take into account the possibility of media deteriorating over time.
Meta Data
The data that describes a record, its context, structure and other attributes is referred to as meta data and is seen as an essential component of any record.
Watch the ISO 27001 Annex A 5.33 Tutorial
In this video I show you how to implement ISO 27001 Annex A 5.33 and how to pass the audit.
ISO 27001 Annex A 5.33 FAQ
Other than your ISO 27001 certification requiring it, the following are the top 5 benefits of ISO 27001 Annex A 5.33 Protection of Records:
You cannot get ISO 27001 certification without it.
Improved security: You will have an effective information security implementation that meets your external requirements for law, regulation, statute and contracts
Reduced risk: You will reduce the information security risks of not meeting external requirements and obligations
Improved compliance: Standards and regulations require you to meet your external requirements
Reputation Protection: In the event of a breach having an effective legal, regulatory, statutory and contract protection of records process in place will reduce the potential for fines and reduce the PR impact of an event
By putting in procedures and addressing protection of records requirements we seek to ensure that the business remains compliant with any legislation and protects records based on risk, business need, legal, regulatory, statutory or society exceptions.
Related ISO 27001 Controls
ISO 27001 Annex A 5.12 Classification Of Information
Further Reading
ISO 27001 Data Retention Policy Beginner’s Guide
ISO 27001 Data Protection Policy Template
Data Retention Policy Template
ISO 27001 Information Classification and Handling Policy Beginner’s Guide
ISO 27001 Controls and Attribute values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Availability | Identify | Legal and compliance | Defence |
| Integrity | Protect | Asset management | ||
| Confidentiality | Information protection |
About the author
Stuart Barker is an information security practitioner of over 30 years. He holds an MSc in Software and Systems Security and an undergraduate degree in Software Engineering. He is an ISO 27001 expert and thought leader holding both ISO 27001 Lead Implementer and ISO 27001 Lead Auditor qualifications. In 2010 he started his first cyber security consulting business that he sold in 2018. He worked for over a decade for GE, leading a data governance team across Europe and since then has gone on to deliver hundreds of client engagements and audits.
He regularly mentors and trains professionals on information security and runs a successful ISO 27001 YouTube channel where he shows people how they can implement ISO 27001 themselves. He is passionate that knowledge should not be hoarded and brought to market the first of its kind online ISO 27001 store for all the tools and templates people need when they want to do it themselves.
In his personal life he is an active and a hobbyist kickboxer.
His specialisms are ISO 27001 and SOC 2 and his niche is start up and early stage business.