ISO 27001 A.5.37 - Documented Operating Procedures

Requirement

“Operating procedures for information processing facilities shall be documented and made available to personnel who need them.”

Plain-language meaning

The organization must document operating procedures for information processing facilities and make the current approved procedures available to the people who need to use them.

Why this matters

Operations fail when critical work depends on memory, tribal knowledge, stale documents, or supplier instructions nobody can find. Documented procedures reduce mistakes, support consistency, protect confidentiality/integrity/availability, and give auditors evidence that operations are controlled.

Implementation guidance

1. Identify operational activities that require documented procedures, such as start-up, shutdown, backup, restore, monitoring, maintenance, media handling, mail handling, CCTV usage, mobile working, safety, cloud administration, network operation, and incident-related operating tasks.
2. Scale procedure detail to the size, complexity, risk, and frequency of the activity. Complex or infrequent procedures need clearer work instructions.
3. Treat operating procedures as controlled documents with owner, approver, version, review date, change history, and access control.
4. Ensure procedures are available to personnel who need them and that staff know where to find the latest version.
5. Protect procedure documents from unauthorized modification and prevent use of obsolete versions.
6. Include supplier or outsourced operations where relevant, using contracts, service documentation, and supplier procedures where operational responsibility sits outside the organization.
7. Review whether procedures are actually followed and whether associated controls can be bypassed.

Audit guidance

Auditors should verify that operating procedures are documented, complete enough for the operational environment, controlled against unauthorized change, current, accessible to personnel who need them, and actually used. Auditors should include outsourced network/cloud/service operations where responsibility is held by another team or supplier.

Evidence examples

Strong evidence

• Operating procedure register lists procedures, owners, approvers, users, scope, version, review date, and storage location.
• Procedures cover relevant day-to-day and infrequent operational activities.
• Procedure documents have version control, approval, change history, and access protection.
• Personnel can find the current approved procedure and explain when to use it.
• Supplier or outsourced operating procedures are available and aligned with contracts/service requirements.
• Compliance checks show procedures are followed and bypasses are identified.

Weak evidence

• Procedures exist but are scattered across chats, personal folders, or old wikis.
• Operators rely on experienced staff rather than documented steps.
• No version control or approval is applied to procedure changes.
• Obsolete procedures remain accessible.
• Supplier procedures are assumed but not available or reviewed.
• Staff cannot identify the current procedure for critical tasks.

Common failures

Exam traps

• A.5.37 is about documented operating procedures for information processing facilities.
• Procedures must be available to personnel who need them, not just written somewhere.
• Procedures should be formal controlled documents with authorized changes.
• The level of detail should match organizational size, complexity, risk, and operational need.
• Supplier and outsourced operations still need documented procedures and service expectations.

Related controls and concepts

• A.5.36 Compliance with Policies, Rules and Standards for Information Security
• Policy Register
• Policy Review Checklist
• Supplier Security Agreement Requirements Checklist
• Supplier Service Review and Change Log
• Internal Audit
• Access Control

KB-ready summary

A.5.37 is part of the assurance and operations governance layer. The practical test is whether the organization can show planned review, controlled work, competent owners, documented evidence, traceable findings, and corrective action where the process does not work.

Templates and checklists

• Operating Procedure Register
• Operating Procedure Review and Change Checklist
• A.5.37 Audit Checklist