I’ve just found a bunch of paper records in our warehouse, mostly supplier contracts and VAT receipts (financial records). Do these need to be kept in a locked cabinet? I believe so but wanted to check.
In a general way, the proper treatment of such information will depend on the results of risk assessment and applicable legal requirements.
For example, if the risks are low and there are no legal requirements, you do not need to apply specific protections for those documents. On the other hand, you may have a legal requirement (e.g., law, regulation, or contract) requiring the use of safes to protect such information.
In case you already have the Information Classification Policy implemented, you need to consider the information classification this information has, and the related treatments identified in the policy.