Documented operating procedures
Procedures for operating information processing facilities are to be written down and made available to the staff who need them.
What the requirement asks
Procedures for operating information processing facilities are to be written down and made available to the staff who need them. Purpose: make information processing facilities run correctly and securely. Guidance: document procedures for security-related operational activities, for example when many people must do the task the same way, when it is done so rarely that people will have forgotten how, when it is new and risky if done wrongly, or before it is handed to new staff. Procedures should state who is responsible; how systems are securely installed and configured; how information is processed and handled automatically and manually; backup (8.13) and resilience; scheduling needs and dependencies on other systems; how to deal with errors and exceptional conditions during jobs, including limits on utility programs (8.18); who to call for support or escalation, including outside suppliers, for unexpected operational or technical problems; storage media handling (7.10, 7.14); restart and recovery after system failure; management of audit trails and system logs (8.15, 8.17) and of video monitoring (7.4); monitoring of capacity, performance and security (8.6, 8.16); and maintenance. Procedures are reviewed and updated as needed, changes to them are authorized, and where technically possible systems are run consistently with the same procedures, tools and utilities. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.
What the guidance adds
Operating procedures are the bridge from policy to work. The guidance asks for the procedure, the current version, the person who follows it and the evidence they did.
Status of the guidance. The guidance lens for 5.37 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep documented operating procedures for security-relevant activities, available to the personnel who perform them and one live sample together.
Evidence an assessor asks for
- Operational documentationDocumented operating procedures for security-relevant activities, available to the personnel who perform them
- Operational documentationProcedures covering installation and configuration, backup, scheduling, error handling, escalation contacts, media handling, restart and recovery, log management, monitoring and maintenance
- Operational documentationVersion history showing authorized changes and periodic review of procedures
- Operational documentationEvidence that rarely performed or newly introduced activities have written procedures
- Operational documentationHandover records showing procedures were provided to new personnel
- Operational documentationEvidence that systems of the same type are managed with the same procedures and tools
The question an assessor will ask
An assessor will ask for documented operating procedures for security-relevant activities, available to the personnel who perform them, then trace it to the system it protects. For A.5.37 the test is whether that record ties to a live sample, not whether the control is named in a policy.
Common gaps
- Procedures exist only in the heads of experienced administrators
- Documents are outdated and do not match current systems
- Recovery and restart procedures are missing for critical systems
- Changes to procedures are made without any authorization
Before the next audit
Before the next audit, check one live sample for this gap: procedures exist only in the heads of experienced administrators.