Skip to main content
All measures

Measure · ISO 27001

Protect records and keep them usable

Connect required records with protection, retention and future readability. Reuse existing repositories and authoritative rules.

Accountable: Business owners with archive or IT operationsReviewed

Reuse existing records

Information protection holds the authoritative handling and retention rules. The deletion plan governs execution. Add the relevant record type and repository to existing inventories.

What to do

  1. 1

    Connect the record type and rule

    Choose a required type of evidence and establish its purpose, applicable legal or contractual requirements and business needs. Link the authoritative retention rule, owner, repository, medium and necessary metadata. Reuse existing registers; a second retention matrix is unnecessary.

  2. 2

    Preserve content and context

    Provide appropriate protection against loss, destruction, manipulation, unauthorised access and disclosure. Preserve provenance, context and necessary relationships with the content. Plan backup, traceable changes and readable reproduction, including formats, software and keys where needed. Include physical and digital records.

  3. 3

    Check usability and disposal

    Open a suitable older sample and check its content, completeness, provenance and retrievability. Adapt storage before formats or media become unusable. At retention expiry, check continuing obligations or justified holds and use the existing deletion workflow. Record results and corrections in the existing review or operational record.

Worked example

An operational example

Fictional example: A signed contract must remain readable and linked to the correct business transaction after a repository change.

Open an older record
DecisionThe business owner checks content and signature, transaction reference, date and access. Missing metadata is added before migration.
EvidenceReviewed version and any corrected repository reference in the existing migration record.

Record the result

  • Record type, applicable retention and protection in the authoritative inventory.
  • Usable sample and traceable correction or disposal.

Common implementation mistakes

Checking only a successful backup

Backup does not establish correct retention or show that content and context remain readable years later.

Related requirement

The references below show which requirements the measure contributes to.

View controls and standards
  • A.5.33 · Schutz von AufzeichnungenGerman guide

    The workflow covers protection, retention basis, context, authenticity, integrity, retrievability, readability and subsequent controlled disposal.

Templates for your implementation

Sources and further reading