ISO 27001 Documented Operating Procedures | Annex A 5.37 | The Lead Auditor’s Implementation and Audit Guide

ISO 27001 Annex A 5.37 is a security control that mandates organizations to establish, maintain, and enforce documented standard operating procedures for all critical information processing facilities. The core business benefit is ensuring operational continuity and significantly reducing human error during technical tasks.

In this guide, I will show you exactly how to implement ISO 27001 Annex A 5.37 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy.

I am Stuart Barker, an ISO 27001 Lead Auditor with over 30 years of experience conducting hundreds of audits. I will cut through the jargon to show you exactly what changed in the 2022 update and provide you with plain-English advice to get you certified.

Key Takeaways: ISO 27001 Annex A 5.37 Documented Operating Procedures

ISO 27001 Annex A 5.37 is a control that requires organizations to create, maintain, and follow detailed written instructions for all information security tasks. Its primary goal is to minimise the risk of human error and ensure that critical security processes, like backups and system updates, are performed consistently regardless of who is doing the work.

Core requirements for compliance include:

• Standard Operating Procedures (SOPs): You must document “recipes” for critical tasks (e.g., user offboarding, patch management, and error handling).
• Accessibility: Procedures must be readily available to the specific staff members who need them; they cannot be hidden in a generic policy folder.
• Change Management: Documents must be treated as living records. They require review (at least annually) and must be updated whenever systems change.
• Audit Verification: Auditors will test that these documents are not just written, but actively used and accurate to the current technical environment.

Essential SOP Checklist

Do it Yourself ISO 27001

Our Lead-Auditor verified templates with expert support have a 100% success rate.

Get the Auditor-Verified ISO 27001 Toolkit.

Understanding Control 5.37: The Cornerstone of a Mature ISMS

Moving from ad-hoc, informal processes to a structured, documented framework is a critical step in maturing an organization’s security posture. Control 5.37 provides the framework for this essential transition, transforming tribal knowledge into a durable corporate asset.

The official requirement of ISO 27001:2022 Annex A 5.37 states:

“Operating procedures for information processing facilities should be documented and made available to personnel who need them.”

The core purpose is to create a repeatable operational environment. This removes ambiguity and reliance on individual memory, a crucial factor for scalable security.

Evolution: 2013 vs 2022

The current version (ISO 27001:2022) is an evolution of the previous Control 12.1.1. While the 2013 version focused heavily on specific technical IT functions (like backups and startup procedures), the 2022 update expands the scope to cover all generalized operational activities related to information security.

Watch the ISO 27001 Annex A 5.37 Tutorial

In this video I show you how to implement ISO 27001 Annex A 5.37 and how to pass the audit.

ISO 27001 Annex A 5.37 Podcast

In this episode: Lead Auditor Stuart Barker and team do a deep dive into the ISO 27001 Annex A 5.37 Documented Operating Procedures. The podcast explores what it is, why it is important and the path to compliance.

Why Documented Operating Procedures are Crucial

• Consistency and Reduced Errors: Uniformity is the best defense against human error.
• Clarity and Accountability: Defines who is responsible for specific security tasks.
• Simplified Training: SOPs serve as the primary training material for new hires.
• Demonstrable Compliance: Bridges the gap between policy (what you say) and reality (what you do).
• Operational Continuity: Ensures tasks continue correctly even when key staff are absent.

Applicability for Modern Businesses

While the control is universal, the application varies by industry. Tailor your documentation to your specific risks.

• Small Businesses: You can use simple procedures for things like data backup, protecting customer information, and handling employee access.
• Tech Startups: For you, it’s all about securing your code, customer data, and intellectual property. Procedures for secure development and handling sensitive data are key.
• AI Companies: You’re dealing with huge amounts of data. You’ll need procedures for data handling, privacy, and ensuring your AI models are secure and fair.

ISO 27100 Annex A 5.37 Implementation Guide

The headline guidance is, document all of your process and procedures. Do it to a level that is appropriate to you. Consider documenting common exception steps or steps in the process when the process does not go as intended.

1. Identify When Procedures Are Needed

You need to start creating these procedures during the planning and implementation phase of your ISO 27001 Information Security Management System (ISMS). They’re a core part of building a robust security framework.

The standard gives examples such as

• when a procedure is performed by many people and needs to be done in the same way
• when something is performed rarely and can be forgotten when it is needed again
• when you do something new and if not done correctly it will create a risk
• before someone else is taking on the procedure

2. Document Procedures

You need to document every process that you do for information security. The list is long. Take every process that you do for information security and document it. The standard provides examples which are basically the processes and procedures of the standard. The following is the bare minimum:

• document secure installation and configuration
• document processing and handling of information, include manual and automatic methods
• document backups and resilience
• document scheduling requirements
• document interdependencies between systems
• document instructions for handling errors
• document support and escalation contacts
• document storage media handling
• document restart and recovery procedures
• document the management of audit logs, system logs, video monitoring, audit trails
• document capacity management
• document maintenance

Essential SOP Checklist

3. Review, Approve, and Distribute

Drafts must be formally approved by management and stored in a central repository (e.g., SharePoint/Intranet) accessible to all staff.

4. Updating procedures

Update and review procedures as needed but at least annually. The standard does not say at least annually. But it will catch you out if you do not.

5. How to write procedures

Writing these procedures is a team effort. You should:

• Keep it simple: Use plain language that anyone can understand.
• Define the purpose: Explain why this procedure is important.
• List the steps: Break down the task into clear, numbered steps.
• Assign responsibilities: Make it clear who does what.
• Get it approved: Have the right people sign off on the procedure.

6. Authorising changes to procedures

When you change something, that change needs to be authorised with some evidence that the authorisation took place.

How to implement ISO 27001 Annex A 5.37

I’ve sat in the Auditor’s chair for 20 years. These are the exact tools I use to guarantee a pass.

Get the Auditor-Proven Toolkit.

How to Audit ISO 27001 Annex A 5.37

The Tools We Use.

100% Audit Success. Zero AI Guesswork.

Get the Auditor-Proven Toolkit.

What an ISO 27001 Auditor Will Look For

Audit Tip: Auditors don’t just want to see the document; they will ask your staff to find it. If your staff cannot locate the procedure in 2 minutes, you may receive a non-conformity.

Audit Readiness Checklist

• [ ] Are procedures documented for key operational activities?
• [ ] Do they include sufficient detail for consistent execution?
• [ ] Is there evidence of management authorization?
• [ ] Can staff demonstrate where to find them?
• [ ] Is there a documented review schedule?

Top 3 Common Mistakes to Avoid

1. Written and Forgotten: Documents created for the audit and never updated.
2. Lack of Detail: High-level summaries instead of actionable steps.
3. Inaccessible: Buried in hidden folders where staff cannot find them.

The Toolkit vs. SaaS Reality Check: Why Ownership Matters

Information Security Standards that need ISO 27001 Annex A 5.37

The main standard that requires these procedures is, of course, ISO 27001. However, having good documentation is also a best practice for other security frameworks like NIST and SOC 2.

Fast Track ISO 27001 Annex A 5.37 Compliance with the ISO 27001 Toolkit

For ISO 27001 Annex A 5.37 (Documented operating procedures), the requirement is to create, maintain, and follow detailed written instructions for all information processing facilities. This control transforms “tribal knowledge” into a durable corporate asset, ensuring that critical security tasks, like user off boarding or backups, are performed consistently regardless of who is doing the work.

Summary: For Annex A 5.37, the auditor wants to see that you have documented “recipes” for critical tasks and proof that your team can find and follow them. The High Table ISO 27001 Toolkit provides the governance framework to satisfy this requirement immediately. It is the most direct, cost-effective way to achieve compliance using permanent documentation that you own and control.

The Impact of Artificial Intelligence (AI) on Operating Procedures

As a Lead Auditor, one of the biggest operational shifts I currently see is the integration of Artificial Intelligence into daily business workflows. If your organisation is developing or deploying AI models, your standard operating procedures must evolve immediately to capture these new, highly complex processes.

Annex A 5.37 requires that all critical information processing activities are documented. When dealing with AI, relying on the “tribal knowledge” of your data scientists is a critical risk and a guaranteed audit failure.

AI-Specific Standard Operating Procedures

To satisfy an auditor that your AI initiatives comply with Annex A 5.37, you must document the following technical procedures:

• Training Data Sanitisation: A documented step-by-step process for scrubbing Personally Identifiable Information (PII) from datasets before they are fed into Large Language Models (LLMs).
• Model Weight Backups: Specific instructions on how, where, and when to backup trained AI model weights and parameters, ensuring intellectual property is not lost during a system failure.
• Prompt Security Reviews: An operational procedure for manually reviewing AI outputs and logs to detect prompt injection attacks or unauthorised data leakage.
• AI Decommissioning: A formalised process for retiring legacy machine learning models and securely destroying the associated training environments.

How to Measure Success: KPIs for Annex A 5.37

You cannot prove that your procedures are effective without metrics. During your Stage 2 certification audit, I will ask your leadership team how they know their documentation is actually working. Establishing Key Performance Indicators (KPIs) provides the exact evidence required to show your ISMS is alive and functioning.

RACI Matrix for Documented Operating Procedures

Clear accountability is vital for maintaining documentation. A RACI matrix (Responsible, Accountable, Consulted, Informed) demonstrates to an auditor that the creation and upkeep of operating procedures is formally embedded in your organisational structure.

Real-World Case Study: An Annex A 5.37 Audit Failure

To help you pass your audit the first time, let me share a scenario where a company failed this exact control due to an over-reliance on tribal knowledge.

The Scenario: I was auditing a fast-growing software development agency. When evaluating Annex A 5.37, I asked to see the documented procedure for granting new developers access to the cloud production environment. The IT Manager confidently told me that the process was highly secure and solely handled by their Senior Cloud Architect, who had memorised the exact configuration steps required.

The Problem: The Senior Cloud Architect was off sick on the day of the audit. I asked a junior systems administrator to walk me through the process instead. Without a documented procedure to follow, the junior administrator logged into the cloud console and demonstrated a workflow that completely bypassed the mandatory Multi-Factor Authentication (MFA) step required by the company’s own security policy.

The Result: A Major Non-Conformity.

The Reason: The organisation had excellent theoretical security, but zero operational resilience. Because the procedure was stored entirely in one person’s head, the process broke down the moment that person was unavailable. To resolve this, the agency had to halt deployments, formally write down the step-by-step account creation process, test it with junior staff, and submit the approved document as evidence of remediation.

How Much Does ISO 27001 Annex A 5.37 Cost to Implement?

Organisations often worry about the financial impact of documenting every operational process. The true cost depends entirely on your chosen strategy and internal resources.

• Time Investment: For a small to medium enterprise, writing procedures from scratch is a massive time sink. A senior engineer can easily spend 10 to 15 hours per week drafting, reviewing, and formatting technical runbooks instead of doing their actual job.
• Financial Cost (Consultant Route): Hiring an external technical writer or ISO consultant to interview your staff and write the procedures for you will typically cost between £4,000 and £8,000 depending on the complexity of your systems.
• Financial Cost (Toolkit Route): Utilising a pre-built ISO 27001 Toolkit is the most cost-effective method. For a single, one-off purchase, you receive fully formatted, auditor-approved Word templates. Your engineers simply fill in the blanks specific to your environment. This reduces the time investment from weeks to mere hours, saving thousands of pounds in lost productivity.

Final Thoughts from the Auditor

ISO 27001 Annex A 5.37 is not about creating unnecessary paperwork; it is about building operational resilience. If your business grinds to a halt or becomes insecure just because a key staff member goes on holiday, you do not have a management system, you have a dependency problem.

Keep your procedures simple, accessible, and accurate. Do not write a 50-page manual when a one-page checklist will do. Ensure your staff know where the documents live, and ensure your management team reviews them annually. If you treat your operating procedures as living tools rather than audit burdens, you will sail through this section of your certification.

The Anatomy of a Perfect ISO 27001 SOP

A common question I receive from clients is, “What exactly does an auditor want to see inside the document?” A compliant Standard Operating Procedure (SOP) under Annex A 5.37 is not just a block of text. It must contain specific governance metadata alongside the technical instructions.

If you are writing your own procedures, ensure every document contains the following standard sections:

Cross-Departmental Responsibilities for Control 5.37

It is a common misconception that Annex A 5.37 only applies to the IT department. Information processing happens across your entire business. To pass your audit, you must ensure that procedures are documented across all relevant departments.

• Human Resources (HR): Must maintain documented procedures for background screening, onboarding, and the secure handling of employee payroll data.
• Facilities Management: Must document procedures for issuing physical access cards, testing fire alarms, and managing visitor logs (tying into Annex A 7).
• IT and Operations: Must document server builds, network configurations, database backups, and incident response runbooks.
• Software Development: Must document secure coding guidelines, code review processes, and deployment pipeline steps.

ISO 27001 Annex A 5.37 Glossary of Terms

Information security is filled with specific terminology. When dealing with operational procedures, you and your management team must understand the following key terms.

Executive Summary and Conclusion

Achieving compliance with ISO 27001 Annex A 5.37 is one of the most practical and beneficial steps you can take for your business. It is not about writing endless manuals that gather dust; it is about protecting your organisation from single points of failure. If your business relies on one key person to run the backups or provision the servers, you are at risk.

As an ISO 27001 Lead Auditor, I can assure you that implementing this control correctly will not only guarantee a successful audit, but it will massively reduce your onboarding times, lower your operational error rates, and improve your overall system stability.

Do not waste weeks trying to invent these documents from scratch. Utilise the High Table ISO 27001 Toolkit to instantly deploy the exact SOP templates, document control policies, and operational frameworks that auditors expect to see. Formalise your operations, secure your knowledge, and pass your audit first time.

ISO 27001 Annex A 5.37 Applicable Laws and Related Standards

ISO 27001 Annex A 5.37 FAQ

Relevant ISO 27001:2022 controls

• ISO 27001 Clause 8.1 Operational Planning and Control
• ISO 27001 Annex A 5.24 Information Security Incident Management Planning and Preparation

Further Reading

• How To Implement ISO 27001: A Step By Step Guide
• ISO 27001 Change Management Policy Beginner’s Guide
• ISO 27001 Logging and Monitoring Policy Beginner’s Guide

Matrix of ISO 27001 Controls and Attribute values

About the author

🎓 MSc Security 🛡️ Lead Auditor ⚡ 30+ Years Exp 🏢 Ex-GE Leader

Stuart Barker

ISO 27001 Ninja

Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigor with extensive operational experience, including a decade leading Data Governance for General Electric (GE).

As a qualified ISO 27001 Lead Auditor, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. His toolkits represent an auditor-verified methodology designed to minimise operational friction while guaranteeing compliance.