Which of the following best describes best practices for security documentation?

• A. Maintaining inaccurate, inaccessible records
• B. Keeping records only for a year
• C. Maintaining accurate, accessible, and auditable records of all security controls and events
• D. Storing records exclusively on paper

Answer: (C)

Maintaining accurate, accessible, and auditable records of all security controls and events is essential because it provides a reliable, traceable basis for proving how protection measures are implemented and how incidents are handled. Accuracy ensures the records reflect reality, so audits and investigations aren’t misled by false or outdated information. Accessibility means the right people can quickly retrieve the records when needed for monitoring, incident response, or compliance checks. Auditable records create a clear trail of who recorded or changed what and when, supporting accountability and the ability to verify ongoing compliance over time. In the context of CTPAT and similar supply‑chain security programs, having these robust records lets auditors see that controls exist, operate as intended, and that the organization can demonstrate continuous improvement and due diligence. The scope should cover all security controls and events, from access logs and surveillance to training records and incident reports.

Keeping records inaccurate, inaccessible, or limited to a short retention period undermines trust and compliance. Relying exclusively on paper reduces accessibility and resilience, making it harder to share information or recover data after a loss.