5.37 Documented operating procedures
Procedures for operating information processing facilities are to be written down and made available to the staff who need them. Purpose: make information processing facilities run correctly and securely. Guidance: document procedures for security-related operational activities, for example when many people must do the task the same way, when it is done so rarely that people will have forgotten how, when it is new and risky if done wrongly, or before it is handed to new staff. Procedures should state who is responsible; how systems are securely installed and configured; how information is processed and handled automatically and manually; backup (8.13) and resilience; scheduling needs and dependencies on other systems; how to deal with errors and exceptional conditions during jobs, including limits on utility programs (8.18); who to call for support or escalation, including outside suppliers, for unexpected operational or technical problems; storage media handling (7.10, 7.14); restart and recovery after system failure; management of audit trails and system logs (8.15, 8.17) and of video monitoring (7.4); monitoring of capacity, performance and security (8.6, 8.16); and maintenance. Procedures are reviewed and updated as needed, changes to them are authorized, and where technically possible systems are run consistently with the same procedures, tools and utilities.
Source: ISO/IEC 27002:2022, 5.37. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Version history showing authorized changes and periodic review of procedures · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- Evidence that rarely performed or newly introduced activities have written procedures · Policy repository / GRC workspace
- Handover records showing procedures were provided to new personnel · Policy repository / GRC workspace
- Evidence that systems of the same type are managed with the same procedures and tools · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Documented operating procedures for security-relevant activities, available to the personnel who perform them · Policy repository / GRC workspace
- Procedures covering installation and configuration, backup, scheduling, error handling, escalation contacts, media handling, restart and recovery, log management, monitoring and maintenance · Policy repository / GRC workspace
First move
Common gaps auditors find
- Procedures exist only in the heads of experienced administrators
- Documents are outdated and do not match current systems
- Recovery and restart procedures are missing for critical systems
- Changes to procedures are made without any authorization
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.36 Compliance with policies, rules and standards for information security · 6.1 Screening