What it asks for. This control expects records to be protected from loss, destruction, falsification, unauthorised access and unauthorised release. It supports legal, regulatory and contractual obligations as well as the organisation's own need to keep evidence of its activities.
In practice. Good practice means identifying which records the organisation must keep, for legal, regulatory, contractual or business reasons, and defining retention periods and storage. Records are protected with suitable controls for integrity and availability, such as access restrictions, backups and immutable storage for important logs, and the ability to read them over time is considered. Auditors expect a retention schedule, evidence of protection and controlled disposal.
Common gaps. Typical gaps are no retention schedule, records held indefinitely by default and media or formats that become unreadable before the retention period ends.