ISO 27001A.5 — Documented operating procedures
A.5.37
Documented operating procedures
ISO 27001 · ISO/IEC 27001:2022 · Last verified July 2026
Objective
Document operating procedures for information processing facilities where needed for correct, secure operations.
Points of focus
- Procedures for critical secure operations
- Version control and owners
- Accessible to people who operate systems
- Updated after major changes
Implementation notes
Prioritise runbooks for privileged and irreversible actions: production deploy, DB restore, key rotation, emergency access. Store next to the systems (repo/wiki) with owners. Update when architecture changes (link A.8.32). Pair with A.5.1 policies — policies set direction; procedures teach the hands.
Audit tip: Ask on-call to open the restore or break-glass runbook and confirm it matches today's systems.
Evidence auditors typically request:
- Runbook repository index
- Sample procedures (restore, break-glass, deploy)
- Change tickets updating runbooks
- On-call use of procedures during incidents
Common gaps
- Procedures outdated vs actual Terraform/CI
- Only screenshots in someone's Downloads
- No procedure for rare but high-impact tasks
Cross-Framework Mapping
| Framework | Requirement | Implementation note |
|---|---|---|
| ISO 27001 | A.5.37 | This control |
Primary sources
- ISO/IEC 27001:2022 Annex A: ISO/IEC 27001:2022 Annex A (A.5.37)
Frequently Asked Questions
Enough for a trained engineer to execute safely under stress — include verification steps and rollback.
No. Cover critical shared operations first; link service-specific notes from a living index.
Automate where safe; still document what the automation does and how to recover when it fails.