Records are the evidence that the policies and procedures on this
wiki are actually being executed. This section is what an auditor opens
after they've read the policies.
ISO/IEC 27001 Clause 7.5 (Documented information) and Clause 9 (Performance
evaluation) require that we retain records and that they are legible,
identifiable, and retrievable.
| Record | Purpose | Cadence | Status |
|---|---|---|---|
| Backup test log (planned) | Evidence that restores are tested | Per service tier — at minimum quarterly | — |
| Access review log (planned) | Evidence that access is reviewed and pruned | Quarterly | — |
| Training log (planned) | Evidence of awareness training and policy acknowledgement | On joining and annually | — |
| Change log (planned) | Evidence that changes follow the change-management procedure | Per change | — |
Records are retained for a minimum of three years, or longer where a
contract, regulation, or legal hold requires. Retention rules per record
type are listed in the Statement of Applicability (planned).