A.5.33 Protection of records
Protect records from loss, destruction, falsification, unauthorized access and unauthorized release.
15
artefacts
4
held by a system
1
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- System access audit log · Identity provider / directory
- Physical vault access log · Physical access / facilities
- Disposal log · SIEM / log platform
- Hash algorithm change log · SIEM / log platform
periodic reviewEvidence produced at each review
- Periodic integrity audit summary · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Record retention schedule · Policy repository / GRC workspace
- Classification matrix · Policy repository / GRC workspace
- Policy approval minutes · Policy repository / GRC workspace
- Privileged user access report · Policy repository / GRC workspace
- Backup plan document · Policy repository / GRC workspace
- Test restore report · Policy repository / GRC workspace
- Backup storage inventory · Policy repository / GRC workspace
- Media wipe certificate · Policy repository / GRC workspace
- Third party disposal agreement · Vendor register / contract repository
- Checksum verification report · Document repository
First move
Start with the 4 of 15 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- retention schedules not aligned with legal requirements
- inadequate logging of physical record access
- backups stored without segregation from production
- absence of documented media sanitization evidence
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA.5.32 Intellectual property rights · A.5.34 Privacy and protection of personal identifiable information (PII)