Protection of Records is a mandatory ISO 27001 security control ensuring information remains authentic and accessible. The primary implementation requirement involves establishing a formal retention schedule and cryptographic safeguards, providing the business benefit of meeting legal obligations while maintaining data integrity for technical audits and legal defence.
What is Protection of Records?
ISO 27001 Protection of Records is an ISO 27001 control called ISO 27001:2022 Annex A 5.33 Protection Of Records. It is about keeping important records and documents safe from damage, loss, or unauthorised changes. It ensures that information is protected throughout its life, from when it’s created until it’s no longer needed. This includes both physical and digital records. The goal is to make sure records are available, accurate, and trustworthy whenever they are needed.
Examples
- Financial Records: Keeping bank statements and invoices safe for seven years so they can be reviewed by auditors.
- HR Files: Storing employee contracts and performance reviews in a locked cabinet or a secure, encrypted digital folder.
- Legal Documents: Making sure that contracts and agreements are signed and then stored in a way that prevents them from being changed without permission.
- Medical Records: Protecting patient health information in a secure database that only authorised medical staff can access.
Context
Organisations create many kinds of records, and many of these records are crucial for legal, business, and historical reasons. The Protection of Records control helps a company meet legal requirements, such as those related to data privacy and financial reporting. It also supports good business practices by making sure that reliable information is always available. By protecting records, a company can prove its actions, defend itself in legal disputes, and ensure a clear history of its operations. This control is vital for maintaining trust and transparency.
How to implement Protection of Records
Implementing a robust framework for the protection of records is a mandatory requirement under ISO 27001:2022 Control 5.33. As a Lead Auditor, I have observed that many organisations fail their technical audits not because they lack data, but because they cannot prove the integrity, availability, and legal compliance of their citable evidence. This 10-step roadmap ensures you formalise technical and administrative safeguards to protect your records from unauthorised modification, loss, or destruction.1. Audit the Centralised Asset Register
Audit the organisational Asset Register to identify all physical and electronic records: This ensures 100% visibility of data requiring protection from unauthorised modification or loss. Technical actions include:
- Identifying the technical owner and custodian for every record set.
- Categorising records by their format, such as digital databases, cloud storage, or physical archives.
- Mapping the data flow of records between internal departments and third-party suppliers.
2. Provision a Legal and Regulatory Register
Provision a citable register of legal, statutory, and contractual requirements for record retention: This identifies specific jurisdictional constraints, such as GDPR or financial reporting laws, that dictate minimum storage durations. Necessary steps involve:
- Documenting the specific retention periods required for tax, employment, and health and safety records.
- Aligning technical storage locations with data residency requirements.
- Ensuring legal counsel reviews the register to verify jurisdictional accuracy.
3. Formalise a Records Retention Policy
Formalise a mandatory retention and disposal policy: This document establishes the technical and administrative lifecycle for every record class within the ISMS. Key requirements include:
- Defining clear “trigger events” for the commencement of retention periods.
- Specifying the technical methods for record preservation to prevent media degradation.
- Securing formal senior management approval to ensure organisational enforcement.
4. Provision Granular Access Controls via IAM
Provision Identity and Access Management (IAM) roles specifically for sensitive record repositories: This ensures that only authorised personnel can view or modify records, enforcing the Principle of Least Privilege. Implementation steps include:
- Mapping user permissions directly to documented job descriptions.
- Revoke access automatically during employee mover or leaver events.
- Implementing “Read Only” permissions for archival data to prevent accidental modification.
5. Provision Multi-Factor Authentication (MFA)
Provision MFA for 100% of administrative access to record storage systems: This mitigates the risk of credential theft resulting in mass record deletion or unauthorised modification. Necessary actions involve:
- Configuring conditional access policies for cloud-based record management systems.
- Enforcing hardware tokens or authenticator apps for high-sensitivity repositories.
- Auditing MFA enrolment status for all users with “Delete” or “Modify” privileges.
6. Formalise Technical Encryption Standards
Formalise technical standards for encrypting records at rest and in transit: This provides a critical safeguard against unauthorised disclosure if physical media or cloud storage is compromised. Technical requirements include:
- Enforcing AES-256 bit encryption for all digital archives.
- Mandating TLS 1.3 for the transfer of records between organisational systems.
- Implementing robust cryptographic key management to ensure records remain accessible for the duration of the retention period.
7. Provision Immutable Backup Solutions
Provision immutable backups for critical organisational records: This prevents malicious code, such as ransomware, from destroying the “gold copy” of essential business records. Necessary steps are:
- Configuring “Write Once, Read Many” (WORM) storage for compliance records.
- Testing the restoration process quarterly to verify data integrity.
- Ensuring backups are stored in a technically isolated environment from primary production systems.
8. Audit Physical Storage Security
Audit the physical security of archive facilities and server rooms: This ensures that paper records and technical hardware are protected from environmental hazards and physical theft. Key actions include:
- Verifying the installation of fire suppression and environmental monitoring systems.
- Implementing technical access logs for all physical record storage areas.
- Conducting site inspections to ensure records are stored in a secure, climate-controlled environment.
9. Provision Secure Destruction Protocols
Provision a technical process for the secure disposal of records: This ensures that records reaching their end-of-life are destroyed using certified methods, providing a citable audit trail. Implementation involve:
- Utilising certified shredding services for physical records.
- Implementing cryptographic erasure (Crypto-Erase) for digital records in cloud environments.
- Collecting and archiving “Certificates of Destruction” as objective audit evidence.
10. Audit Effectiveness and Compliance
Audit the records management framework annually: This verifies that technical controls are functioning as intended and that the organisation remains 100% compliant with ISO 27001:2022 Control 5.33. Verification methods include:
- Executing a spot-check of record retention dates against the master schedule.
- Reviewing system logs to identify unauthorised attempts to access or modify records.
- Updating the technical Risk Register based on findings from internal audits.
Protection of Records FAQ
What is the protection of records in ISO 27001?
Protection of records is the process of ensuring that information generated by the Information Security Management System (ISMS) remains authentic, reliable, and usable. Under ISO 27001:2022 Annex A 5.33, organisations must protect records from loss, unauthorised access, and destruction for their entire required retention period.
How long must ISO 27001 records be retained?
The standard does not mandate a specific timeframe, but 100% of organisations must define retention periods based on legal, regulatory, and business requirements. Typically, financial records are kept for 6 to 7 years in the UK to comply with HMRC regulations, while ISMS audit logs are often kept for 12 to 24 months.
What are examples of records that require protection?
Key records that must be protected to demonstrate compliance include:
- Internal and external audit reports.
- Risk assessment and risk treatment plans.
- Management review meeting minutes.
- Training records and competence logs.
- Security incident reports and investigation outcomes.
How do you ensure the integrity and authenticity of records?
To ensure integrity, 85% of high-performing ISMS implementations utilise digital signatures, write-once-read-many (WORM) storage, or strict access controls. Authenticity is maintained by ensuring that every record is attributable to a specific individual or automated process, preventing retrospective unauthorised alterations or deletions.
What is the difference between documents and records in ISO 27001?
Documents are “living” files that provide instructions or define processes, such as policies that can be updated. Records are “frozen” evidence of a past activity or result that occurred at a specific point in time; once a record is created, it should not be changed.
Relevant ISO 27001 Controls
The following controls from the ISO/IEC 27001:2022 standard are related to protection of records:
- ISO 27001:2022 Annex A 5.33 Protection Of Records: the main ISO 27001 control for protecting records.
- ISO 27001:2022 Annex A 5.1: Policies for Information Security: Policies and rules that guide how records should be protected.
- ISO 27001:2022 Annex A 5.10 Acceptable Use Of Information And Other Associated Assets: Making sure employees handle records correctly and with care.
- ISO 27001:2022 Annex A 5.18 Access Rights: Limiting who can view, edit, or delete records.
- ISO 27001:2022 Annex A 5.19 Information Security In Supplier Relationships: Ensuring that any company you work with also protects your records.
- ISO 27001:2022 Annex A 5.23 Information Security For Use Of Cloud Services: Securing records stored on cloud platforms.
- ISO 27001:2022 Annex A 6.4: Disciplinary Process: Having a process to handle situations where someone misuses or mishandles records.
- ISO 27001:2022 Annex A 7.4: Physical Security Monitoring Using cameras or guards to protect physical records from theft or damage.
- ISO 27001:2022 Annex A 8.8: Management of Technical Vulnerabilities: Finding and fixing weaknesses in systems that store digital records.
- ISO 27001:2022 Annex A 8.9: Configuration Management: Making sure the settings on systems that store records are secure and correct.
- ISO 27001:2022 Annex A 8.28: Secure Coding: Writing software code in a way that protects digital records from being misused or stolen.
| Related ISO 27001 Control / Concept | Relationship Description |
|---|---|
| ISO 27001 Annex A 5.33: Protection of Records | Core Control: The primary requirement for ensuring that records are protected from loss, destruction, falsification, unauthorized access, and unauthorized release, in accordance with legislative, regulatory, contractual, and business requirements. |
| ISO 27001 Annex A 5.1: Policies for Information Security | Governance Framework: Provides the high-level rules and organizational mandates that dictate how records must be classified, handled, and stored throughout their lifecycle. |
| ISO 27001 Annex A 5.18: Access Rights | Operational Security: Vital for limiting record access to authorized personnel only, preventing unauthorized modification or deletion of sensitive business and legal documents. |
| ISO 27001 Annex A 5.10: Acceptable Use | Human Factor: Establishes the expected behavior for employees when handling physical and digital records to prevent accidental damage or exposure. |
| ISO 27001 Annex A 5.23: Cloud Services | Modern Storage: Specifically addresses the security requirements when records are stored on third-party cloud platforms, ensuring they remain encrypted and accessible only to the organization. |
| ISO 27001 Annex A 7.4: Physical Security Monitoring | Physical Guardrail: Uses measures like cameras and restricted access areas to protect physical archives and paper-based records from theft or environmental damage. |
| Glossary: Availability | Security Objective: A key goal of protecting records is ensuring they are “Available”—meaning they can be found and accessed by authorized users exactly when needed for audits or legal defense. |
| Glossary: Integrity | Security Objective: Ensuring the “Integrity” of records means protecting them from unauthorized changes, making the information trustworthy and accurate for historical and business purposes. |
| ISO 27001 Glossary of Terms (Main Index) | Parent Directory: The central index where Protection of Records is categorized as a vital organizational and legal compliance term. |
The Tools We Use.
100% Audit Success. Zero AI Guesswork.
About the author
