Control Definition
Records must be protected against loss, destruction, falsification, unauthorized access, and unauthorized release, in line with the legal, regulatory, contractual, and business requirements that apply to them — for the entire period those requirements say they must be kept.
Control Objective
To keep the records the organization is obliged to hold authentic, intact, retrievable, and properly protected throughout their retention period, and properly disposed of at the end of it.
What This Really Means
A record is information that has been promoted to evidence. Most of what your organization holds is working material — drafts, dashboards, documents that change daily. A record is different: it is the frozen proof that something happened. The contract was signed, the transaction was processed, the access was approved, the incident was handled, the consent was given. The moment information becomes proof, new rules attach to it: keep it for a defined period, keep it unchanged, keep it retrievable, and show it only to the people entitled to see it. A.5.33 is the control that enforces those rules.
The working artifact is a retention schedule: one table listing each record type, how long it must be kept, the requirement that sets that period — a statute, a regulator, a contract clause, or a business decision — where the record lives, who owns it, and what happens at the end. The periods come from outside more often than from inside: tax and accounting law, employment law, sector regulators, and customer contracts all impose retention minimums, which is why the schedule should trace back to the legal register maintained under A.5.31. Typical record families: accounting and transaction records, contracts and agreements, HR and personnel files, consent and approval records, audit logs, incident records, and the ISMS records the standard itself generates.
Protection then has to hold across the whole lifecycle, against the five named threats: loss, destruction, falsification, unauthorized access, and unauthorized release. That means access control and encryption for confidentiality, but also integrity measures — restricted edit rights, hashes or timestamps, write-once (WORM) or immutable storage for records that may face legal scrutiny — and a longevity plan, because media deteriorates and formats die. A record you cannot open in year six of a ten-year retention is just as much a failure as one deleted in year two: plan format migration, test readability periodically, and retain the cryptographic keys for any encrypted archive as carefully as the archive itself. And the lifecycle ends: when retention expires and no legal hold applies, records should be disposed of through the deletion discipline of A.8.10 — keeping everything forever is liability, not safety.
For auditors, the heart of the control is the schedule plus a retrieval test. Expect them to ask for the retention schedule early, check it has an owner and a review date, then pick one aging record and ask to see it — intact, readable, access-controlled, with the disposal trail for whatever has already expired. "We keep everything forever" is not a retention policy; it is a finding wearing a confident face.
Why It Matters
Records are what the organization stands on in disputes, audits, investigations, and regulatory examinations. When a contract dispute arrives, the signed agreement and its amendment trail decide it; when a regulator asks how a decision was made, the approval record answers; when an incident ends in legal action, the logs and response records carry evidentiary weight only if their integrity is demonstrable. A missing or tampered record does not make the obligation disappear — it makes you lose by default.
Over-retention fails in the opposite direction. Every record kept past its requirement widens the blast radius of a breach, inflates discovery and storage costs, and — where the record contains personal data — turns hoarding into a privacy violation in its own right. The control is two-sided by design: keep what you must, protect it while you keep it, and dispose of it when you may.
Organizations that neglect record protection face:
- •Lost legal standing – records that are missing, altered, or of undemonstrable integrity collapse the organization's position in disputes, investigations, and litigation
- •Regulatory penalties – statutory retention minimums in tax, financial, and employment law are enforced, and "we deleted it early" is an admission, not a defense
- •Undetected falsification – records anyone can edit can be rewritten to conceal fraud or error, and an audit trail that can be altered proves nothing
- •Unreadable archives – decayed media, dead formats, and lost encryption keys quietly destroy records that are still legally required, discovered only when someone finally asks for them
- •Over-retention liability – personal data and sensitive records kept past need enlarge breach impact, discovery exposure, and privacy noncompliance simultaneously
Regional Compliance Context
India-connected organizations inherit retention floors and ceilings from several directions at once. The CERT-In directions require security logs for in-scope systems to be retained for 180 days — treat that as a floor in the log-management entries of your retention schedule. The DPDP Act 2023 pulls the other way for personal data: retain it only as long as the purpose or another legal duty requires (full compliance obligations land by 13 May 2027), which makes documented disposal as important as documented retention. Banks and regulated financial entities also carry record-keeping obligations under RBI master directions, and market intermediaries under SEBI requirements — those periods belong in the schedule with their citations, sourced from the A.5.31 register.
In the Gulf, Saudi Arabia's PDPL and the UAE federal PDPL apply the same retention-limitation principle to personal data: holding it without a current purpose or legal basis is itself a violation, so the disposal half of this control is not optional housekeeping.
Implementation Guidance
Inventory Your Record Types and Where They Come From
Workshop with finance, HR, legal, operations, and the CISO to list the record families the organization actually produces: contracts, accounting and transaction records, personnel files, consent and approval records, audit logs, incident records, ISMS records. For each, note the source of the retention requirement — statutory, regulatory, contractual, or business — pulling citations from the A.5.31 legal register rather than from folklore.
Build the Retention Schedule
One table: record type, retention period, the requirement behind it, the system or location holding the authoritative copy, the owner, and the disposal action at end of life. Where requirements conflict across jurisdictions, record the longest applicable period and the reasoning. Keep it to the record types you genuinely hold — a 30-row schedule that is accurate beats a 300-row template nobody can defend.
Protect Records in Storage Against the Five Threats
Apply access control so records are readable only by entitled roles, encryption where confidentiality demands it, and redundancy against loss. Match the protection level to the record's classification under A.5.12. The threats named by the control — loss, destruction, falsification, unauthorized access, unauthorized release — are the checklist: for each record type, be able to say which measure answers which threat.
Guard Authenticity and Integrity for Records With Evidentiary Weight
For records that may face legal or regulatory scrutiny — audit logs, financial transactions, incident evidence, signed agreements — add integrity measures: restricted or removed edit rights, cryptographic hashes or trusted timestamps, WORM or immutable storage with retention locks, and chain-of-custody documentation where records support investigations (tie to A.5.28). A record is only evidence if you can show nobody could quietly change it.
Plan for Media and Format Longevity
For every retention period longer than a few years, ask whether the media and format will outlive it. Schedule migration off aging media, prefer long-lived open formats (PDF/A for documents, standard exports for structured data) over proprietary ones, and run periodic readability tests on a sample of archived records. Retain the decryption keys for encrypted archives under the key-management discipline of A.8.24 — losing the key destroys the record as surely as deleting it.
Dispose at End of Retention — With a Legal Hold Exception
When a record's period expires, dispose of it through the secure deletion practices of A.8.10 and record the disposal: what, when, under which schedule entry, by whom. Build one exception path: a legal hold procedure that suspends disposal for records relevant to litigation, investigation, or regulatory inquiry, with named authority to raise and lift holds. Disposal should be routine and evidenced, not an annual panic.
Assign Ownership and Review the Schedule on Triggers
Name an owner for the schedule — typically compliance or the CISO, with record-type owners in each function — and review it at least annually plus on triggers: a legal register change, a new market, a new contract template, or a system migration that moves authoritative records. Verify during review that every schedule entry still points at a live, retrievable system; decommissioned platforms are where required records silently die.
Audit Evidence
During your ISO 27001 certification audit, auditors will expect to see the following evidence to demonstrate compliance with A.5.33:
Documentation
- Records retention schedule listing record types, retention periods, the requirement behind each, storage locations, and owners
- Records management procedure covering storage, handling, integrity protection, retrieval, and disposal
- Disposal records or certificates of destruction showing records destroyed on schedule, plus the legal hold procedure and any active holds
- Storage configuration evidence: access restrictions, WORM or immutability settings, retention locks on record repositories
- Media migration or readability test records demonstrating long-retention records remain accessible
Interviews
- Records or compliance owner on how retention periods were derived from legal and contractual sources and when the schedule was last reviewed
- IT or storage administrator on how systems enforce retention, immutability, and restricted access for record repositories
- Legal counsel or a department head on how legal holds are raised, communicated, and lifted
Observations
- A retrieval test: an older record sampled from the schedule produced intact, readable, and within a reasonable time
- Live inspection of storage settings — retention locks, immutable or WORM configuration, and access permissions on a records repository
- A completed disposal traced end to end, from schedule trigger to destruction record
Practitioner Insights
A retention schedule is a claim; retrieval is the proof. The test I run in audits is simple — pick a record near the end of its retention period, a five-year-old approval or a closed incident from three years back, and ask to see it now. The failure pattern is always the same: the schedule says ten years, but the system it points to was decommissioned in a migration and nobody moved the records, or the archive is encrypted with a key that left with an administrator. Map every schedule entry to a live system and run one retrieval per record type yourself, before an auditor or a court does it for you.
The mistake I see constantly in smaller organizations is treating backups as the records program. Backups are for recovery — they expire in weeks and they restore everything or nothing; records need years, item-level retrieval, and protection against tampering, which is a different design entirely. The fix does not need a records management suite: a three-column spreadsheet — record type, period, where it lives — covering the ten types you actually face (contracts, invoices, HR files, access approvals, incident records, audit logs) beats a 40-page records policy that names none of your systems. Start from what a court, a regulator, or a customer could actually demand from you.
Common Challenges & Solutions
Challenge
Nobody can say which retention periods actually apply, so the schedule is guesswork or copied from a template.
Solution
Derive periods from sources, not templates: walk the A.5.31 legal register with counsel and pull the statutory and regulatory minimums, then sweep your largest customer contracts for retention and return-or-destroy clauses. Where no external requirement exists, set a business-justified period and record the reasoning. Every row in the schedule should be able to answer "says who?".
Challenge
Records are scattered across email, shared drives, SaaS tools, and personal folders, with no authoritative copy.
Solution
Designate one authoritative system per record type — the contract repository for contracts, the HRIS for personnel files, the ticketing system for incident records — and write it into the schedule. Treat copies elsewhere as working material, not records, and aim retention enforcement at the authoritative store. Trying to govern every stray copy fails; governing the system of record works.
Challenge
Backups get conflated with archives, so teams believe records are "kept" when they are merely temporarily recoverable.
Solution
Separate the two by design: backups follow the recovery objectives of A.8.13 and expire on backup rotation; records follow the retention schedule and need item-level retrieval and integrity protection. Where a record type currently survives only inside backups, move it to proper archival storage with its own retention setting. Test the difference with a question: can you produce one specific record from four years ago without restoring an entire system?
Challenge
Long-retention records outlive the media, formats, and encryption keys they were stored with.
Solution
Put longevity on the calendar: a periodic readability test of sampled archives, migration planning whenever a storage platform or format is retired, and key escrow for encrypted archives managed under A.8.24 so departures do not orphan the data. Prefer open, durable formats at the point of archiving. The cost of migration is predictable; the cost of an unreadable statutory record is not.
Challenge
Disposal never happens because deleting anything feels riskier than keeping everything.
Solution
Make disposal a routine, evidenced process rather than a judgment call: the schedule defines when, A.8.10 practices define how, and a disposal record proves it happened. Handle the genuine exceptions through a legal hold procedure with named authority, so litigation risk is managed explicitly instead of by hoarding. Where records contain personal data, privacy law converts over-retention from caution into violation — which is usually the argument that finally unlocks disposal.
