ISO 27001 Annex A 5.33 Protection of records
What it says
Records shall be protected from loss, destruction, falsification, unauthorized access and unauthorized release.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure records are safe from loss, damage, falsification, and unauthorised access.
This control is about keeping important records safe and accurate. Imagine losing important documents like contracts or employee records due to damage or hacking. This could lead to serious legal and business issues, so it's crucial to protect these records from being lost, changed, or accessed by unauthorised people.
Free. Save your status, tasks and notes.
Why it matters
Loss or falsification of records can lead to severe legal liabilities and inability to demonstrate compliance or operational continuity.
How to implement
IT managers should create a secure system for storing records.
This means using reliable software that keeps data safe and makes backups regularly, ensuring that records can be recovered if something goes wrong.
HR departments must set clear rules for who can access different types of personnel records.
This involves setting permissions in the system so only authorised staff can view and alter sensitive information.
Legal teams need to establish a retention policy aligning with Australian laws like the Privacy Act 1988.
They should define how long records should be kept based on legal requirements and ensure they're disposed of securely once they're no longer needed.
Office managers should ensure proper physical storage conditions for paper records.
This includes using fireproof cabinets and controlling access to storage areas to prevent damage or unauthorised access.
Senior management should oversee the implementation of a training program for employees.
This program should inform staff about the importance of handling records securely and the procedures they should follow.
Keep it running
Audit record access logs, run integrity checks, and ensure backups meet retention policies to prevent unauthorised access, loss, or tampering.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The organisation's records retention schedule.
Look at
How different types of records are classified and the scheduled timeframes for retention. Good example includes clearly defined categorisations and retention periods that comply with applicable laws and company policies.
- Check 2 of 5What an auditor asks for
Look at
Backup frequency and restoration processes.
Good evidence
Setup includes regular, automated backups with an easy recovery process that is periodically tested.
- Check 3 of 5What an auditor asks for
Ask for
To see the access control policy for records.
Look at
How access rights are granted and monitored for sensitive records.
Good evidence
Policy tightly controls access with regular audits and documented logs showing who accessed which records and when.
- Check 4 of 5What an auditor asks for
Look at
Attendance records and training materials.
Good evidence
Program includes comprehensive materials and shows high participation from relevant staff.
- Check 5 of 5What an auditor asks for
Ask for
Documentation on the disposal process of obsolete records.
Look at
Procedures about how records are securely destroyed.
Good evidence
Process ensures confidential destruction of no longer needed records in compliance with legal and organisational standards.
Mappings
Closest match in ASD Essential Eight: E8-AH-ML2.13, Protect event logs from unauthorised changes or deletion, which this control covers in full and more.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.5.3.
ISO/IEC 42001:2023 Annex A 5.3 mandates documenting and retaining AI impact assessment results. ISO/IEC 27001:2022 Annex A 5.33 requires record protection from loss and unauthorised actions, directly addressing the security of stored AI impact assessment records.
ASD Essential Eight: 2 mappings
This control is broader than E8-AH-ML2.13.
E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion to preserve their integrity for detection and investigation. Annex A 5.33 requires protection of records from loss, destruction, falsification and unauthorised access/release, which can include logs when treated as organisational records. Annex A 5.33 is broader (all records and more threat types), while E8-AH-ML2.13 is focused specifically on event log tampering and erasure.
This control is broader than E8-RA-ML2.8.
E8-RA-ML2.8 requires event logs to be protected from unauthorised modification and deletion. Annex A 5.33 of ISO/IEC 27001:2022 requires records (a broader category that can include logs) to be protected from loss, destruction, falsification, unauthorised access and unauthorised release. E8-RA-ML2.8 is a specific application of record protection focused on log integrity/availability rather than all organisational records and confidentiality aspects.
ASD Information Security Manual: 5 mappings
This control is broader than ISM-1815.
Annex A 5.33 requires records to be protected from loss, destruction, falsification, unauthorised access and unauthorised release. ISM-1815 specifically requires protection of event logs (a type of record) from unauthorised modification and deletion, directly supporting integrity and availability of that record class. The ISO control is broader because it also covers other record types and additionally covers unauthorised access and release.
This control is broader than ISM-1985.
Annex A 5.33 requires records to be protected from loss, destruction, falsification, unauthorised access and unauthorised release. ISM-1985 requires event logs (records) to be protected from unauthorised access, aligning directly to the confidentiality aspect of record protection. Annex A 5.33 is broader because it covers many record types and additional threats such as destruction and falsification.
This control is broader than ISM-1989.
Annex A 5.33 requires records to be protected from loss and destruction, which includes having appropriate retention and preservation arrangements. ISM-1989 mandates that event logs are retained in line with National Archives of Australia retention requirements, which supports the availability and evidentiary value of this record type. ISM-1989 focuses on retention compliance for event logs and does not directly address unauthorised access/release or anti-tampering controls that Annex A 5.33 also requires.
This control partially overlaps ISM-0407.
Annex A 5.33 requires records to be protected from loss, destruction, falsification, unauthorised access and unauthorised release. ISM-0407 overlaps by mandating a secure, lifecycle record of user access authorisations and reviews, which underpins accountability and helps prevent or investigate unauthorised access to records. ISM-0407 focuses on access administration evidence, while Annex A 5.33 is broader and includes protecting the records' integrity/availability and preventing unauthorised release.
This control partially overlaps ISM-1586.
ISM-1586 mandates keeping logs to record all imports and exports of data, which ensures evidentiary records of transfers. Annex A 5.33 addresses the protection of records from loss, destruction, or unauthorised access, applicable to the integrity of data transfer logs as records. However, Annex A 5.33 does not require creating transfer logs, and ISM-1586 does not detail specific record protection measures.
ASD Essentials for enterprise IT: 2 mappings
This control is broader than IT.DET-01.1.
IT.DET-01.1 requires event logs to be protected from unauthorised access, modification or deletion, including through encryption and by securing the systems and accounts that store, manage and analyse them. Because event logs are records, this is a specific case of Annex A 5.33, which requires records to be protected from loss, destruction, falsification, unauthorised access and unauthorised release. Annex A 5.33 applies to all organisational records, while IT.DET-01.1 covers only event logs but is more prescriptive about the protections required.
- IT.DET-01.3Establish centralised event log storage protected from unauthorised access and tamperingBroader than
This control is broader than IT.DET-01.3.
IT.DET-01.3 requires a centralised event log storage capability that protects logs from unauthorised access or modification. As event logs are records, this is a specific case of Annex A 5.33, which requires records to be protected from loss, destruction, falsification, unauthorised access and unauthorised release. Annex A 5.33 applies to all organisational records and a wider set of threats, while IT.DET-01.3 is limited to event logs held in a central store.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.