All 93 controls · Organizational controls
Control 5.33
Protection of records
What ISO/IEC 27002:2022 control 5.33 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Records are to be safeguarded against being lost, destroyed, falsified, accessed without authorization or released without authorization. Purpose: meet legal, regulatory and contractual obligations and community or societal expectations about keeping records protected and available. Guidance: so records stay genuine, trustworthy, complete and usable as their business context and management needs evolve, issue guidelines on storing and handling records, chain of custody and disposal, including preventing tampering, aligned with the records management policy; and prepare a retention schedule naming records and how long each is kept. The storage and handling arrangements should identify records and their retention periods with regard to national or regional law and, where relevant, societal expectations, and allow proper destruction once a record is no longer needed. Protection of particular records takes account of their classification. Records are grouped into types (for example accounting, transaction, personnel, legal), each with its retention period and the physical or electronic media allowed. Storage systems are chosen so that records come back quickly enough and in a usable format. For electronic media, procedures keep records accessible and readable for the whole retention period despite technology change, and the keys and programs for encrypted archives or digital signatures are kept for as long as the records (8.24). Storage and handling follow media manufacturers' recommendations and allow for media deterioration. Other information: records evidence events, transactions or processes and are information assets in any form; metadata describing their context, content, structure and management is essential; law may fix retention periods and content; ISO 15489 covers records management.
Purpose in the standard’s terms, in our words: Ensures compliance with legal, regulatory and contractual obligations and societal expectations for protecting and keeping records available.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Identify, Protect; Legal and compliance, Asset management, Information protection; Defence.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | IdentifyProtect |
| Operational capabilities | Legal and complianceAsset managementInformation protection |
| Security domains | Defence |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- Records handling guidelines covering storage, chain of custody, tamper prevention and disposal, aligned with the records management policy
- A retention schedule listing record types, retention periods, legal basis and permitted storage media
- Evidence of controlled destruction at the end of retention periods
- Procedures and tests demonstrating that electronic records remain readable across format and technology changes
- Retention of cryptographic keys and software needed to read encrypted or signed archives for the full retention period
- Records of media condition checks or migration to counter deterioration
Where audits commonly find gaps
- No retention schedule exists, so records are either kept forever or deleted early
- Encrypted archives cannot be opened because the keys were not retained
- Legacy formats can no longer be read and no migration was planned
- Records are held in systems that allow alteration without any audit trail
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 3 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (18.1.3) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.