Documents and Records Management Procedure

1. Purpose

This procedure controls the documented information of the information security management system. It makes sure that people use the current approved version of a policy or procedure, that every change is reviewed and traceable, and that the evidence the system produces (records) is complete, protected, kept for the right time and then disposed of securely.

It separates two things that are often confused. A document states what should happen and can change; a record shows what did happen and must not be altered.

2. Scope

• In scope: policies, procedures, plans, standards, manuals, work instructions, forms and templates, and external documents on which the system depends, such as contracts, regulations and supplier reports.
• In scope: records produced by the ISMS, such as risk assessments, access reviews, incident reports, audit reports, training records, meeting minutes and approvals.
• In scope: all formats (electronic, paper, audio, image) and all storage locations, including cloud storage and email.
• Out of scope: business records governed by their own legal retention rule only, such as tax filings, unless they also serve as ISMS evidence. Personal data retention follows the Data Protection and Privacy Procedure, which prevails where it is shorter.
• Applies to: all document owners, authors, reviewers, approvers and users of ISMS documents.

3. Terms and definitions

4. Roles and Responsibilities

5. Document Control Procedure

5.1 Document identification and version control

Every controlled document carries the same header or footer data so that a reader can tell at once what it is and whether it is current.

5.2 Document creation, review and approval

1. RequestAnyone may ask for a new document or a change by raising a document change request (Annexure C) to the ISMS Manager, stating the reason and the proposed owner.
2. DraftThe document owner or author prepares the draft from the approved template, written in plain language, using decision values in brackets for adopter choices. Target: within [15 working days].
3. ReviewAt least one reviewer from each affected function checks the draft and records comments in the document system. Reviewers reply within [5 working days].
4. ResolveThe author resolves comments, noting the reason for any not accepted. The ISMS Manager checks consistency with related documents and the master list.
5. ApproveThe approver signs electronically in the document system. Authority follows the table below.
6. PublishThe ISMS Manager sets the status to Approved, updates the master list and revision history and announces the change within [2 working days].
7. TrainWhere practice changes, the owner arranges briefing or training before the effective date.

5.3 Approval authority

5.4 Document distribution and access control

• The controlled copy lives only in [the document management system]. Staff open documents from there; they do not email attachments as the source.
• Access is by role. Read access for Internal documents is for all staff; Confidential and Restricted documents are limited to named groups. Edit rights are limited to the owner and author.
• Documents carry the classification in the header; Restricted documents also have view-only and watermark settings.
• Printed copies are marked uncontrolled with the date; they are destroyed after use and not filed.
• External parties receive a document only after approval of the owner, under a confidentiality agreement, and by a secure channel; the recipient and version are logged.
• Changes are notified by the system to the roles on the distribution list, and new starters are shown where to find the documents.
• Documents are backed up with the document system under the Backup Management and Retention Procedure.

5.5 Document obsolescence and withdrawal

1. DecideA document is withdrawn when it is replaced, no longer applies or the activity has stopped. The owner submits a change request giving the reason.
2. ApproveThe approver who approved the document authorises withdrawal.
3. MarkThe status changes to Superseded or Withdrawn and a banner reads that the document must not be used. The replacement, if any, is named.
4. ArchiveThe old version moves to a read-only archive kept for [3 years] after withdrawal, or longer if a law, contract or audit needs it.
5. RemoveThe ISMS Manager removes it from working locations, intranet pages and training material, and retrieves any printed copies.
6. UpdateThe master list records the date and reason.

5.6 External documents

Laws, standards, customer requirements and supplier documents that the ISMS depends on are identified on the master list as external documents with their source, version and date received. The owner checks for a new version every [6 months] or when notified, and the ISMS Manager is told when a change affects a policy or procedure.

6. Record Control Procedure

6.1 Record identification and retention

Each process owner identifies the records the process produces and lists them against the retention schedule in Annexure B. A record is identified by type, date, creator and the process it belongs to. Names and locations are consistent so that auditors and the owner can find a record in under [10 minutes]. Where the record type is not on the schedule, the record owner asks the ISMS Manager to add it before the record is created.

6.2 Record storage and protection

• Records are stored in the system designated for their type, never only on personal drives, in email or on removable media.
• Completed records are locked or stored as read-only; corrections are made as a dated addendum, not by overwriting.
• Access is limited by classification and need to know, with a log of who opened or changed High-sensitivity records.
• Electronic records stay readable for the full retention period: file formats are checked for obsolescence every [12 months] and records converted when needed.
• Paper records are kept in locked cabinets or an approved archive room, protected from fire, water and unauthorised access, and signed in and out.
• Records are included in backups; restoration of a sample is tested under the Backup Management and Retention Procedure.
• Digital signatures or approval logs are used where a record must show who approved it.

6.3 Record retention and disposal

1. TriggerThe retention period starts at the event in the schedule (for example, completion of the audit, end of the contract, closure of the incident).
2. ListEach [quarter] the record owner produces a list of records that have reached the end of retention.
3. CheckLegal counsel and the ISMS Manager confirm that no legal hold, audit, dispute or investigation applies and that no other document requires longer keeping.
4. ApproveThe record owner approves disposal in writing; Restricted records also need approval from the ISMS Manager.
5. DisposeIT operations deletes electronic records, including copies and backups on their cycle, using secure deletion; paper is cross-cut shredded or pulped by an approved vendor with a certificate. Media follows the Asset Disposal Process.
6. RecordLog what was disposed of, the date, method and approvers in the disposal log (kept [permanently]).

6.4 Legal hold

When legal counsel or senior management tells the ISMS Manager that records are needed for an investigation, claim or inquiry, disposal of all records that may be relevant stops at once and automated deletion jobs are suspended for those records. The hold lasts until counsel releases it in writing. The ISMS Manager keeps a register of holds and reminds counsel every [6 months] to confirm that each is still needed.

7. Record Retention Schedule

The schedule below gives default periods. Where law or a contract requires longer, the longer period applies. The ISMS Manager maintains the full schedule in Annexure B with legal counsel and reviews it every [12 months].

8. Document and Record Review

Each document is reviewed by its owner on the cycle shown in the master list, or earlier after an incident, an audit finding, a change in law or a significant change to the Organisation. The review records one of three outcomes: no change, change required, or withdraw. The date is recorded even when no change is made. The ISMS Manager reports documents overdue by more than [30 days] to management each month. Once a year the ISMS Manager samples [10] record types and checks that records exist, are in the right place and are retained or disposed of according to the schedule.

9. Classification and Labelling

Documents and records are classified according to the Information Classification and Handling Procedure. The level is chosen by the owner at creation and reviewed when the document changes.

• Electronic files carry the label in the document properties and the file location; paper copies are marked on every page.
• A compilation takes the highest classification of any part, and an extract is labelled on its own content.
• Unlabelled documents are treated as Internal until the owner labels them, and Restricted if they hold personal or credential data.
• Records reclassified downward need the approval of the owner and are logged.

10. Compliance and Communication

• Every new or changed document is announced by [email and the intranet] with a one-line summary of what changed and who is affected.
• Staff acknowledge Confidential policy changes in the learning platform within [10 working days].
• The ISMS Manager checks the master list each [month] for overdue reviews, orphan documents with no owner and duplicates, and reports exceptions.
• Internal audit tests the procedure at least once a year: currency of copies in use, approval evidence, record retrieval and disposal logs.
• Failures are raised as nonconformities under the ISMS Compliance Scheduled Activities Plan and tracked to closure.

11. Measures

12. Records and evidence

Annexure A: Document master list

Annexure B: Record retention schedule

Annexure C: Document change request form

13. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

14. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

15. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• ISMS Manual
• Information Security Policy
• Information Classification and Handling Procedure
• Data Protection and Privacy Procedure
• Backup Management and Retention Procedure
• Asset Disposal Process
• ISMS Compliance Scheduled Activities Plan