Control A.5.37Documented operating procedures
Operating procedures for information processing facilities must be documented and made available to personnel who need them.
The least glamorous control in Annex A and one of the more consequential in an incident. The test is simple: could a competent person who is not the usual person carry out the task from what is written down?
Procedures matter most when the person who normally does the work is unavailable — which is the situation continuity planning under A.5.30 assumes and which key-person dependency makes acute.
“Made available to personnel who need them” ties back to clause 7.5.3’s availability requirement, and it is where procedures stored inside the system they describe become useless at the moment they are needed.
The balance to strike is currency over completeness. An exhaustive procedure that is a year out of date is more dangerous than a brief one that is accurate, because it will be followed.
How to put this in place
When important tasks live in one person's head, they are done differently each time and fail when that person is away. Written procedures make them repeatable.
- Identify the tasks where a mistake would hurt, such as backups, deployments, user administration and incident handling.
- Write short procedures with an owner.
- Keep them where the people doing the work will find them.
- Review them when systems change.
- Check by observation that staff follow them.
Evidence an auditor usually looks for: the procedures with owners and review dates, staff following them when observed, and procedures matching current systems.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists documented operating procedures for IT operations among the documents auditors commonly expect for this control.