AMC1 IS.I.OR.245(c)&(d) Record-keeping

• ED Decision 2023/009/R found in: Information Security (2023/203 and 2022/1645) Part-IS (Jun 2024)

AMC1 IS.I.OR.245(c)&(d) Record-keeping ED Decision 2023/009/R When complying with the requirements under points (c) and (d) for all the records required by points [IS.I.OR.245](#_DxCrossRefBm1193569545) (a) and (b), the organisation should consider the following: (a)     Records should be kept in paper form or in electronic format or a combination of both media. The records should remain accessible whenever needed within a reasonable time and usable throughout the required retention period. The retention period starts when the record has been created. (b)     Records data integrity, availability and authenticity should be protected in consistency with protection of corresponding operational data, and as such, should be within the scope of the ISMS. (c)      Storage systems should be protected against unauthorised access (i.e. data leakage attempts against personal data/modification of records) and thus should have information security measures implemented in consistency with the level of information security risk associated with them. (d)     Once records are not required to be retained anymore, the destruction of records and decommissioning of assets used for their storage should be implemented appropriately. ##### AMC1 IS.I.OR.245(c)&(d) Record-keeping *ED Decision 2023/009/R* When complying with the requirements under points (c) and (d) for all the records required by points [IS.I.OR.245](#_DxCrossRefBm1749084281) (a) and (b), the organisation should consider the following: (a) Records should be kept in paper form or in electronic format or a combination of both media. The records should remain accessible whenever needed within a reasonable time and usable throughout the required retention period. The retention period starts when the record has been created. (b) Records data integrity, availability and authenticity should be protected in consistency with protection of corresponding operational data, and as such, should be within the scope of the ISMS. (c) Storage systems should be protected against unauthorised access (i.e. data leakage attempts against personal data/modification of records) and thus should have information security measures implemented in consistency with the level of information security risk associated with them. (d) Once records are not required to be retained anymore, the destruction of records and decommissioning of assets used for their storage should be implemented appropriately.