5.37 Documented operating procedures
Requires the operating procedures used to run information processing facilities to be written down and made available to the personnel who need them.
5
artefacts
0
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Records of update following change to the system or the process · Document repository
governing documentDocuments that govern the control
- The set of documented operating procedures for information processing facilities, covering routine operation, backup, monitoring, incident handling and restart · Policy repository / GRC workspace
- Evidence procedures are available to the personnel who need them, including during an outage of the primary system that hosts them · Policy repository / GRC workspace
- Version control and review records, showing procedures are current against the systems they describe · Policy repository / GRC workspace
- Evidence procedures are followed, such as completed run sheets, checklists or ticket records referencing them · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Procedures held only in the wiki or system that is itself unavailable during the incident they are needed for
- Documentation written at implementation and never updated, so it describes a superseded platform
- Knowledge held by one individual with the procedure never written down at all
- Procedures exist but operations run from memory, with no record tying an activity to the documented step
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.36 Compliance with policies, rules and standards for information security · 6.1 Screening