Control A.5.37Documented operating procedures
What it means in practice
Operating procedures for information processing facilities must be documented and made available to personnel who need them.
The least glamorous control in Annex A and one of the more consequential in an incident. The test is simple: could a competent person who is not the usual person carry out the task from what is written down?
Procedures matter most when the person who normally does the work is unavailable — which is the situation continuity planning under A.5.30 assumes and which key-person dependency makes acute.
“Made available to personnel who need them” ties back to clause 7.5.3’s availability requirement, and it is where procedures stored inside the system they describe become useless at the moment they are needed.
The balance to strike is currency over completeness. An exhaustive procedure that is a year out of date is more dangerous than a brief one that is accurate, because it will be followed.
How to put this in place
When important tasks live in one person's head, they are done differently each time and fail when that person is away. Written procedures make them repeatable.
- Identify the tasks where a mistake would hurt, such as backups, deployments, user administration and incident handling.
- Write short procedures with an owner.
- Keep them where the people doing the work will find them.
- Review them when systems change.
- Check by observation that staff follow them.
Evidence an auditor usually looks for: the procedures with owners and review dates, staff following them when observed, and procedures matching current systems.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Excel
Mandatory ISMS Documentation Checklist
in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists documented operating procedures for IT operations among the documents auditors commonly expect for this control. - Word
Vulnerability Triage & Remediation Operating Procedure
in Vulnerability & Exposure ManagementIts Framework References list this control. Supported by: Whole procedure. - Word
Policy Framework Standard
in Security Policy ManagementIts Framework References list this control. Supported by: The Procedure tier; PF-01, PF-08. - Word
Policy Lifecycle Operating Procedure
in Security Policy ManagementIts Framework References list this control. Supported by: Whole procedure, as a documented operating procedure. - Word
Monthly Patch Cycle Operating Procedure
in Patch ManagementIts Framework References list this control. Supported by: The whole procedure: a documented, repeatable operating routine. - Word
Regulatory Notification Operating Procedure
in Regulatory Incident Notification & ReportingIts Framework References list this control. Supported by: The whole procedure: a documented operating procedure for reporting. - Word
Backup Operations & Restore Test Procedure
in Backup & Restore AssuranceIts Framework References list this control. Supported by: The whole procedure: documented operating procedures for backup operations.