Documents and Records Policy
Standards for managing the organization's documents and records
Purpose
Establish how the organization's information and records are classified, handled and managed to protect their confidentiality, integrity and availability.
Objectives
- Ensure staff understand the importance of properly classifying and handling information.
- Define how information and records are classified, protected and managed.
- Establish clear guidelines for handling sensitive and confidential information.
Scope
Applies to all employees, contractors and third parties who access or manage information within the organization's information security management system.
Information and Records Classification
Information is classified into three categories:
Confidential Information whose unauthorized access can harm the organization. Examples: internal financial information, strategies, trade secrets.
Sensitive Information whose unauthorized access can affect people. Examples: personal data, medical information, confidential customer data.
Public Information intended to be disclosed externally. Examples: official announcements, marketing content, public reports.
Information and Records Handling
Handling must match the classification:
-
Confidential and sensitive:
- Access only with a legitimate need.
- Used exclusively for the defined purpose.
- Stored in secure locations (encryption at rest and in transit).
- Transmitted through secure methods (encrypted email, SFTP, etc.).
- Not disclosed to unauthorized people, inside or outside the organization.
-
Public:
- May be shared according to the organization's communication needs.
Document Labeling
Labels standardize information handling:
Public For documents without sensitive information. They may be freely disclosed.
Private For confidential documents. Access restricted to authorized people. Requires protection and careful handling.
Authenticated users For sensitive documents that require prior authentication. Higher level of control and protection.
Document and Record Retention
- Human Resources records: retained for up to 7 years.
- Financial records: retained for up to 12 years.
- Once the retention period has ended, records must be securely deleted.
Records Management
Records must be managed according to their classification and retention period. Deletion must be done securely to prevent subsequent unauthorized access.
Responsibilities
All staff and third parties must:
- Correctly classify information.
- Protect sensitive and confidential information.
- Access only what is necessary for their duties.
- Store and transmit sensitive information through secure methods.
- Avoid unauthorized disclosures.
- Report incidents of improper access, use or disclosure.
- Manage records following the established retention periods.
Monitoring and Review
The policy is reviewed regularly to keep it current and aligned with good practices. Any update must be approved by management and the security team. Changes will be communicated and training updated as appropriate.