Key takeaways
- Write down operating procedures and make them available to those who need them.
- Documented procedures make operations consistent, help new staff and keep work going when people are absent.
- Start here: identify operational tasks that need written procedures: backups, onboarding, patching.
Purpose
Write down operating procedures and make them available to those who need them.
Requirement
Requirement summaryOperating procedures for information processing facilities shall be documented and made available to personnel who need them.
Why it matters
Documented procedures make operations consistent, help new staff and keep work going when people are absent.
How to implement
- Identify operational tasks that need written procedures: backups, onboarding, patching.
- Write short, step-by-step procedures and keep them current.
- Make them available to the people who need them.
- Review after process or system changes.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.37. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Written procedures for key IT and security tasks.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.37 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Procedures with version numbers, owners and review dates.
- Proof the procedures are available to the people who need them.
Things you should be able to show or explain
- Be able to show a task being done the way the procedure says.
How much to show: Three to five critical tasks.
Common mistakes
- Procedures out of date.
- Critical tasks only one person knows how to do.
- Procedures that describe how things used to be done.
- Critical knowledge held only in one person's head.
- Tip: Runbooks in a wiki are perfectly acceptable.
Policies & documents to have
- Operations Security Policy
FAQ
Is A.5.37 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.37?
Be ready to explain how the control works in your organisation and to provide things like: Written procedures for key IT and security tasks…