ISO 27001 A.5.33: protecting records, explained for startups

A.5.33 Protection of records

Important records are kept for the right time and protected from loss or change. What proves it: how long each type of record is kept, and how records are protected from loss or change.

A certification auditor samples retention schedule and record protection settings. A file that usually does the job: a retention schedule plus backup or versioning settings on the storage that holds records.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.5.33 walks you through it in this order.

1. List the records you must keep: finance, staff, customer contracts and security logs.
2. Set a retention period for each and turn on versioning or backup.
3. Review the schedule once a year.

The free ISO 27001 readiness assessment asks 2 questions that evidence it:

• Do you have a records protection and document control practice?
• Do you delete data when you no longer need it?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Control of Documented Information Policy covers A.5.33. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criterion that cover this ground: CC2.1, reliable information.

Organizational controls

A.5.33 is one of the 37 organizational controls in Annex A. How the company runs security: policies, roles, suppliers, incidents, continuity and legal duties. Most of these are written decisions and the records that show you follow them.

Nearby controls in the same theme:

• A.5.30, technology continuity
• A.5.31, legal and contract duties
• A.5.32, intellectual property
• A.5.34, personal data protection
• A.5.35, independent security review
• A.5.36, checking policy compliance

Before it: A.5.32, intellectual property. After it: A.5.34, personal data protection. Every control, by theme, is on the Annex A controls page.