Documentation, Standards and Regulations
Domain 9 checks that you keep records that would survive an audit, and that you know which standard or law governs a situation. Items are often compliance-judgement questions rather than definitions.
Operations records
Typical records: shift handover log, fault and incident log, change record, backup and restore log, maintenance record, access and audit log, asset inventory and configuration baseline, and licence records. Good records are contemporaneous (written at the time), accurate, attributable to a named person, and retained for the defined period. Electronic records need backup and access control; personal data inside logs must be minimised.
Standards and laws
ITIL is a good-practice framework, not a certifiable standard. ISO/IEC 20000 covers service management, ISO/IEC 27001 the information security management system, ISO 22301 business continuity. In China, multi-level protection of cybersecurity (classified protection, GB/T 22239) grades systems and imposes controls by level. The Cybersecurity Law, Data Security Law and Personal Information Protection Law require minimum necessary collection, lawful basis, restrictions on cross-border transfer, and breach reporting. Records retention periods vary by record type - audit and financial records are usually longer than operational logs.
Worked example
At 23:00 an operator is told to delete six months of old logs to free disk space. Reasoning and action: check the retention policy first - audit logs may require twelve months and change records longer; identify which files are operational and which are audit; archive the eligible files to approved storage with a checksum, obtain the owner's written approval, delete only the approved set, and record the action with time, approver and scope. Do not delete audit logs, and do not bypass the approval because it is late at night.
Traps
- Verbal handover with no written record.
- Backdating or completing records after the fact as if written at the time.
- Deleting logs to solve a capacity problem.
- Copying production personal data to a personal device for testing.
- Assuming an ITIL certificate means legal compliance, or that a framework is a mandatory standard.