ISO 27001 for Paper Records: Controls and Audit Evidence

ISO 27001 protects information, not only digital files. A signed contract in a cabinet, a visitor book at reception, printed patient notes, engineering drawings and handwritten meeting notes can all affect confidentiality, integrity or availability.

Paper is often overlooked because security teams concentrate on technical systems. Yet paper can be copied without logs, carried outside controlled locations, altered without version history, damaged by water or fire, or retained long after its purpose ends. A sound ISMS treats these as information risks and applies proportionate controls throughout the record’s lifecycle.

Include paper in the information view

Start by identifying paper records through business processes rather than trying to count every sheet. Ask each process owner where information is created, printed, signed, received, stored, transported, archived and destroyed.

Typical sources include:

• HR and occupational-health files;
• legal agreements and corporate records;
• finance approvals and payment support;
• customer forms and identity documents;
• visitor, delivery and security logs;
• design drawings and maintenance records;
• handwritten incident or investigation notes;
• emergency procedures; and
• printouts used in meetings or operational areas.

Record the information category, owner, location, sensitivity, retention basis and normal movement. The asset may be a record series or business collection rather than each individual page. The asset inventory and ownership guide explains how to keep the inventory useful without recording meaningless detail.

Classify by consequence and use

Apply the same classification logic used for electronic information. Consider what could happen if a paper record were disclosed, changed, unavailable or mistaken for the current version.

Classification should lead to handling rules. A public brochure needs little protection. Payroll records may require restricted storage, controlled copying and secure disposal. A safety instruction may need strong availability and version control even if it is not confidential.

The ISO 27001 information-classification guide shows how to connect labels and handling rules. For paper, labels may be printed markings, coloured covers, cabinet identifiers or process context. Avoid visible markings that reveal sensitive subject matter to unauthorised viewers.

Design controls across the paper lifecycle

Creation and printing

Limit printing when it creates risk without a business need. Configure secure release for shared printers where practical, locate devices away from public areas and require prompt collection. Printed records should show enough identity, date or version information to prevent confusion, especially where an obsolete instruction could cause harm.

Control blank forms if unauthorised use could enable fraud or false records. For handwritten information, define how it becomes part of the official record and how corrections remain attributable.

Active use

Personnel need practical rules for desks, meeting rooms, home offices, vehicles and customer sites. Protect documents when temporarily unattended and return them to controlled storage after use. Meeting owners should collect sensitive handouts and clean whiteboards where information has been recorded.

If a record is copied or scanned, the new version enters its own lifecycle. Define which copy is authoritative, where the scan is stored and whether the original must be retained.

Storage

Select storage according to confidentiality, integrity, availability and environmental risk. Possible measures include lockable cabinets, controlled rooms, fire-resistant storage, elevated shelving, intrusion detection and restricted key management.

A locked cabinet is only effective if keys are controlled and the surrounding area has suitable access restrictions. For critical archives, consider water, fire, pests, temperature, recovery priority and the ability to locate a required record promptly.

Movement and transfer

Paper can move internally, between sites, to customers, to courts or to storage providers. Define packaging, authorised recipients, handover records, tracking and what to do after a failed delivery. Sensitive material should not be left visible in vehicles or public spaces.

Where couriers or archive providers are used, supplier agreements and monitoring should address security, incident notification, retrieval and disposal. The organisation remains responsible for understanding the risk even when custody changes.

Retention and disposal

Retention periods should reflect legal, regulatory, contractual and business requirements. Indefinite retention increases exposure and storage cost. Premature destruction can remove required evidence.

At the end of retention, use a destruction method appropriate to the sensitivity and form. Protect material awaiting destruction, authorise disposal and retain evidence where needed. Outsourced destruction may require certificates, service monitoring and occasional observation, but a certificate alone does not prove every record followed the process.

Map risks to relevant control areas

Paper protection rarely depends on one Annex A control. Depending on risk, relevant areas may include information classification, labelling, information transfer, physical entry, securing offices and facilities, clear desk, storage media, supplier relationships, privacy and records protection.

Use the free Annex A control lookup to explore relationships, then confirm applicability through the risk treatment process and Statement of Applicability. The licensed standards remain the source for exact requirements and control guidance.

Preserve useful evidence

Separate evidence that controls were designed from evidence that they operated.

Control stage	Design evidence	Operating evidence
Identification	Record categories and ownership rules	Sample inventory entries and owner reviews
Handling	Approved handling requirements	Observed use, printer release and transfer samples
Storage	Site and cabinet rules	Access records, key records and inspection results
Retention	Approved retention schedule	Destruction batches and authorised exceptions
Supplier custody	Contract and security requirements	Retrieval tests, service reviews and incident records

Photographs can support a site inspection, but use them carefully. A photograph may capture personal or confidential material and proves only a moment in time. Record location, date, observer and the condition tested, and store the image with suitable access.

Audit by following records

A process walk-through is more informative than asking whether cabinets lock. Select several record types with different sensitivity and follow each from creation or receipt through use, storage, movement and end-of-life.

Choose samples from multiple contexts: headquarters, a branch, a home worker, an archive provider and a process with frequent printing. Include an exception or incident where possible. Sample selection should be risk-based; the free risk score calculator can help structure initial prioritisation.

Useful audit questions include:

• Which paper records would materially affect the organisation if lost or disclosed?
• How do personnel recognise and handle their classification?
• Who can access cabinets, archives and key stores?
• How are records protected during movement?
• Can the organisation retrieve a critical paper record within the required time?
• How are expired records identified and authorised for disposal?
• What happens when a document is missing, delivered incorrectly or found unattended?

Observe normal working conditions. A prepared tour immediately after a clean-up can conceal weak operation. Corroborate interviews with cabinet access, storage conditions, printer areas, transfer records and destruction evidence.

Evaluate findings proportionately

A pass could show known record categories, consistent handling, restricted storage, traceable transfers and timely disposal. A partial result might show strong central-office controls but inconsistent home-working or archive-provider evidence. A fail could involve sensitive files stored openly, no retention decisions, uncontrolled keys or repeated missing records without investigation.

One unattended low-sensitivity page is different from systematic exposure of personnel files. Record the information involved, location, duration, access opportunity, recurrence and response. The finding should connect objective evidence to risk and the organisation’s own control design.

Manage hybrid records explicitly

Many records move between paper and digital forms. A signed page may be scanned, emailed, uploaded and archived while the original remains in storage. Without a defined authoritative version, teams can make decisions from different records.

For each hybrid workflow, decide:

• which version is the official record;
• how completeness and legibility are checked after scanning;
• who may alter metadata;
• whether and when the original can be destroyed;
• how holds or investigations suspend normal disposal; and
• how access is removed from redundant copies.

Digital conversion reduces some physical risks but introduces access, backup and integrity concerns. Treat conversion as a change in risk, not automatic risk elimination.

Keep the programme operational

Review paper-record controls after office moves, remote-working changes, acquisitions, supplier changes and incidents. Include facilities, legal, privacy, records management, HR and process owners. Security alone rarely knows every retention duty or operational need.

ISO’s official ISO/IEC 27001 overview describes an information-security management system in terms of managing risks to information. It is deliberately not limited to a storage technology. The practical audit question is therefore simple: can the organisation identify important paper information and show that protection works throughout its lifecycle?