Annex A 5.33verifiedISO/IEC 27001:2022
Protection of Records
Ensure records are safe from loss, damage, falsification, and unauthorised access.
record_voice_over
Plain language
This control is about keeping important records safe and accurate. Imagine losing important documents like contracts or employee records due to damage or hacking. This could lead to serious legal and business issues, so it's crucial to protect these records from being lost, changed, or accessed by unauthorised people.
01 - Overview
Framework
ISO/IEC 27001:2022
Control effect
Preventative
ISO 27001 domain
Organisational controls
Classifications
N/A
Official last update
24 Oct 2022
Control Stack last updated
18 June 2026
Official control statement
Records shall be protected from loss, destruction, falsification, unauthorized access and unauthorized release.
verifiedISO/IEC 27001:2022Annex A 5.33
priority_high
Why it matters
Loss or falsification of records can lead to severe legal liabilities and inability to demonstrate compliance or operational continuity.
settings
Operational notes
Audit record access logs, run integrity checks, and ensure backups meet retention policies to prevent unauthorised access, loss, or tampering.
02 - Implement
build
Implementation tips
- IT managers should create a secure system for storing records. This means using reliable software that keeps data safe and makes backups regularly, ensuring that records can be recovered if something goes wrong.
- HR departments must set clear rules for who can access different types of personnel records. This involves setting permissions in the system so only authorised staff can view and alter sensitive information.
- Legal teams need to establish a retention policy aligning with Australian laws like the Privacy Act 1988. They should define how long records should be kept based on legal requirements and ensure they're disposed of securely once they're no longer needed.
- Office managers should ensure proper physical storage conditions for paper records. This includes using fireproof cabinets and controlling access to storage areas to prevent damage or unauthorised access.
- Senior management should oversee the implementation of a training program for employees. This program should inform staff about the importance of handling records securely and the procedures they should follow.
03 - Audit
fact_check
Audit / evidence tips
- AskThe organisation's records retention schedule
- GoodSetup includes regular, automated backups with an easy recovery process that is periodically tested
- AskTo see the access control policy for recordsGoodPolicy tightly controls access with regular audits and documented logs showing who accessed which records and when
- GoodProgram includes comprehensive materials and shows high participation from relevant staff
- AskDocumentation on the disposal process of obsolete recordsGoodProcess ensures confidential destruction of no longer needed records in compliance with legal and organisational standards
04 - Mappings
link
Cross-framework mappings
How Annex A 5.33 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
E8
| Control | Notes | Details |
|---|---|---|
layersPartially meets(2)expand_less | ||
| E8-RA-ML2.8 | E8-RA-ML2.8 requires event logs to be protected from unauthorised modification and deletion | |
| E8-AH-ML2.13 | E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion to preserve their integrity for detection an... | |
handshakeSupports(1)expand_less | ||
| E8-RB-ML1.6 | Annex A 5.33 requires records to be protected against loss, destruction, falsification, unauthorised access and unauthorised release | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(2)expand_less | ||
| ISM-0407 | Annex A 5.33 requires records to be protected from loss, destruction, falsification, unauthorised access and unauthorised release | |
| ISM-1586 | ISM-1586 mandates keeping logs to record all imports and exports of data, which ensures evidentiary records of transfers | |
handshakeSupports(8)expand_less | ||
| ISM-0316 | Annex A 5.33 requires records to be protected from unauthorised release and from loss/destruction across their lifecycle | |
| ISM-0371 | Annex A 5.33 requires records to be protected from unauthorised access and unauthorised release, including during end-of-life handling | |
| ISM-0373 | Annex A 5.33 requires records be protected from loss, destruction, falsification, unauthorised access and unauthorised release across the... | |
| ISM-1059 | Annex A 5.33 requires protection of records against unauthorised access and unauthorised release as well as loss and falsification | |
| ISM-1080 | ISM-1080 requires that encryption of media uses an AACA or high assurance algorithm, reducing the likelihood that stored records can be a... | |
| ISM-1814 | Annex A 5.33 requires protection of records from loss and destruction as well as unauthorised changes | |
| ISM-1866 | ISM-1866 requires organisations to prevent personnel from saving OFFICIAL: Sensitive or PROTECTED data onto privately owned devices | |
| ISM-1989 | Annex A 5.33 requires records to be protected from loss and destruction, which includes having appropriate retention and preservation arr... | |
linkRelated(2)expand_less | ||
| ISM-1815 | Annex A 5.33 requires records to be protected from loss, destruction, falsification, unauthorised access and unauthorised release | |
| ISM-1985 | Annex A 5.33 requires records to be protected from loss, destruction, falsification, unauthorised access and unauthorised release | |
ISO 42001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| Annex A 5.3 | Annex A 5.3 (ISO/IEC 42001:2023) mandates documenting and retaining AI impact assessment results | |
handshakeSupports(3)expand_less | ||
| Annex A 4.3 | Annex A 4.3 requires the organisation to document information about data resources used by AI systems | |
| Annex A 6.2.7 | Annex A 6.2.7 requires the organisation to produce and provide AI system technical documentation to relevant interested parties in an app... | |
| Annex A 7.5 | Annex A 7.5 requires a defined and documented process for recording data provenance for AI systems over time, creating provenance records... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ISO 27001 controls in Organisational controls
Annex A 5.30
ICT Readiness for Business Continuity
Annex A 5.31
Compliance with Information Security Legal Requirements
Annex A 5.32
Intellectual Property Rights Protection
Annex A 5.34
Privacy and Protection of Personally Identifiable Information
Annex A 5.35
Independent review of information security
Annex A 5.36
Review compliance with information security policies
See all Organisational controls controls, or browse the full ISO 27001 library.
school
Want to implement this control?
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.