The ultimate how to implement guide to ISO 27001 Annex A 5.37 Documented Operating Procedures.
Table of contents
- 1. Identify Critical Operational Tasks
- 2. Standardise the Runbook Format
- 3. Document System Start-up and Shut-down
- 4. Detail Backup and Recovery Operations
- 5. Map Scheduled Automated Tasks
- 6. Define Error Handling and Escalation
- 7. Implement Configuration Management Guidelines
- 8. Enforce Version Control on Procedures
- 9. Segregate Operational Duties
- 10. Conduct the ‘Bus Factor’ Test
1. Identify Critical Operational Tasks
Control Requirement: Determine which activities are essential for the continuous operation of systems.
Required Implementation Step: Audit the daily, weekly, and monthly routine of your SysAdmin and DevOps teams. List every task required to “keep the lights on,” such as server patching, log review, database indexing, and certificate renewal. Do not assume knowledge; if it’s in a senior engineer’s head, it must be extracted.
Minimum Requirement: A prioritised list of at least 20 critical maintenance and operational tasks requiring documentation.
2. Standardise the Runbook Format
Control Requirement: Ensure procedures are consistent and easy to follow.
Required Implementation Step: Abandon Microsoft Word. Create a standardised Markdown or Confluence template for “Runbooks”. This must include: Prerequisite Access, Estimated Time, Step-by-Step Commands, Expected Output, and Rollback Steps. Treat documentation as code, living where the engineers work.
Minimum Requirement: A standard Runbook template applied across the engineering department.
3. Document System Start-up and Shut-down
Control Requirement: Define the correct sequence for booting and stopping complex systems.
Required Implementation Step: Document the exact dependency order for restarting your infrastructure (e.g., “Database must be healthy before API Gateway is started”). Include specific CLI commands or AWS Console actions. This is critical for disaster recovery situations where standard automation may have failed.
Minimum Requirement: Tested start/stop procedures for the primary production environment.
DO IT YOURSELF
ISO 27001
All the templates, tools, support and knowledge you need to do it yourself.
4. Detail Backup and Recovery Operations
Control Requirement: Ensure data restoration is repeatable and reliable.
Required Implementation Step: Do not just say “Restore from Backup.” Write the exact syntax to retrieve the artifact, decrypt it, and load it into a fresh instance. Include contact details for off-site storage providers or access paths to “Cold Storage” vaults (e.g., AWS Glacier).
Minimum Requirement: A “Recovery Guide” that a junior engineer could successfully follow without supervision.
5. Map Scheduled Automated Tasks
Control Requirement: Document the logic behind automated jobs.
Required Implementation Step: Create a register of all Cron jobs, Windows Task Scheduler items, and Lambda triggers. Explain what the script does, when it runs, and who receives the alert if it fails. Undocumented automation is a major availability risk.
Minimum Requirement: A “Job Dictionary” mapping every automated script to its business function and owner.
6. Define Error Handling and Escalation
Control Requirement: Instruct staff on what to do when procedures fail.
Required Implementation Step: In every operating procedure, include a “Troubleshooting” section. Define specific error codes or failure scenarios and the immediate escalation path (e.g., “If HTTP 500 persists > 5 mins, Page the On-Call Engineer”).
Minimum Requirement: Escalation trees embedded within technical documentation.
7. Implement Configuration Management Guidelines
Control Requirement: Ensure secure baseline configurations are maintained.
Required Implementation Step: Document the standard build process for new servers or containers (e.g., “The Gold Image”). Include instructions for applying the CIS Benchmark or security hardening scripts immediately upon provisioning.
Minimum Requirement: A “Server Build Standard” document referenced in the provisioning process.
8. Enforce Version Control on Procedures
Control Requirement: Ensure staff are using the current version of instructions. Required Implementation Step: Store operating procedures in a Version Control System (like Git) or a wiki with version history. Prohibit the use of local PDF copies or printed manuals which quickly become obsolete. The “Master” branch is the only source of truth.
Minimum Requirement: Evidence of version history and change authorship for all critical runbooks.
9. Segregate Operational Duties
Control Requirement: Prevent a single person from executing end-to-end critical risks. Required Implementation Step: Structure procedures so that high-impact tasks (e.g., deploying to Production or modifying root keys) require a second pair of eyes or a distinct approval step. Document where the hand-off occurs within the procedure.
Minimum Requirement: Procedures for high-risk tasks explicitly requiring a secondary approver.
10. Conduct the ‘Bus Factor’ Test
Control Requirement: Verify that procedures are usable by others. Required Implementation Step: Once a year, assign a critical task to a competent engineer who does not usually perform it. Ask them to execute the task using only the documentation. If they have to ask questions, the documentation is failed and must be rewritten.
Minimum Requirement: Records of “Peer Review” execution of operating procedures.
About the author
