Information Security Fundamentals, 2nd Edition

Asset Classification  ◾  301

Records Management Policy

An organization’s records are one of its most important and valuable assets. Almost

every employee is responsible for creating or maintaining organization records of

some kind, whether in the form of paper, computer data, optical disk, electronic mail,

or voice mail. Letters, memoranda, and contracts are obviously information records,

as are things such as a desk calendar, an appointment book, or an expense record.

Organizations are required by law to maintain certain types of records, usually

for a specified time. e failure to retain such documents for these minimum peri-

ods can subject an organization to penalties, fines, or other sanctions or could put it

at a serious disadvantage in l