Are written records of security checks required?

Are written records of security checks required?

• A. They are required.
• B. They are a good security practice but not required.
• C. They are prohibited.
• D. They must be kept for 10 years.

Answer: (B)

Documenting security checks is about creating an auditable trail that shows who performed the check, when it happened, and what the outcome was. This helps ensure accountability, spot gaps, and provide evidence during audits or investigations. While this practice strongly supports security, it isn’t universally mandated in every situation—policies can vary, and some organizations rely on electronic systems or manager attestations rather than standalone written logs. Retention of these records also depends on specific policy or schedule, not a fixed rule like keeping them for a set number of years. So, keeping written records is a best practice for security, but not a blanket requirement.

Documenting security checks is about creating an auditable trail that shows who performed the check, when it happened, and what the outcome was. This helps ensure accountability, spot gaps, and provide evidence during audits or investigations. While this practice strongly supports security, it isn’t universally mandated in every situation—policies can vary, and some organizations rely on electronic systems or manager attestations rather than standalone written logs. Retention of these records also depends on specific policy or schedule, not a fixed rule like keeping them for a set number of years. So, keeping written records is a best practice for security, but not a blanket requirement.