65 lines
2.4 KiB
Markdown
65 lines
2.4 KiB
Markdown
Title: Records Retention and Disposal Policy
|
|
Document ID: [POL-RECORDS-001]
|
|
Version: 0.1 Draft
|
|
Status: Draft
|
|
Owner: CISO (Paul Jenkins)
|
|
Approver: CEO (Paul Hague)
|
|
Classification: Internal
|
|
Effective date: [DD Month YYYY]
|
|
Review date: [DD Month YYYY]
|
|
|
|
# Records Retention and Disposal Policy
|
|
|
|
## Purpose
|
|
|
|
This policy defines BlackDice's high-level requirements for retaining and disposing of business and ISMS records in a controlled manner.
|
|
|
|
## Scope
|
|
|
|
This policy applies to records created or maintained within the ISMS scope, including governance records, risk records, incident records, audit outputs, supplier records, and supporting operational evidence.
|
|
|
|
## Objectives
|
|
|
|
- retain records for as long as required by business, legal, contractual, and assurance needs
|
|
- dispose of records securely when retention is no longer required
|
|
- support traceability, evidence, and defensible record handling
|
|
|
|
## Principles / Policy Statements
|
|
|
|
Records must be retained according to defined retention requirements that reflect legal, regulatory, contractual, operational, and assurance needs.
|
|
|
|
Records must remain accessible, accurate, and protected for the duration of their retention period.
|
|
|
|
Disposal of records must be controlled and appropriate to the sensitivity of the information involved.
|
|
|
|
ISMS records such as risks, incidents, audit findings, management reviews, and exceptions must be retained in a way that supports oversight and auditability.
|
|
|
|
Where operational tooling is used as the system of record, retention and disposal arrangements must be understood and controlled.
|
|
|
|
## Roles and Responsibilities
|
|
|
|
- [Role] must define retention and disposal expectations.
|
|
- Record owners must ensure records are retained and disposed of appropriately.
|
|
- System owners must support retention controls where records are stored in business systems.
|
|
|
|
## Compliance / Exceptions
|
|
|
|
Any exception to approved retention or disposal requirements must be documented and approved by the relevant authority.
|
|
|
|
## Monitoring and Review
|
|
|
|
This policy should be reviewed through record sampling, legal change monitoring, audit, and management review.
|
|
|
|
## Related Documents
|
|
|
|
- Information Security Policy
|
|
- Document and Records Control Standard
|
|
- Data Retention Standard
|
|
- Legal and Regulatory Obligations Register Template
|
|
|
|
## Version Control
|
|
|
|
| Version | Date | Description of Change | Author |
|
|
| --- | --- | --- | --- |
|
|
| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |
|