ISO27001 Annex A 5.37 Documented operating procedures Beginner's Guide

ISO 27001 Documented Operating Procedures – Annex A 5.37

ISO 27002:2022 Clause 5.37 Documented Operating Procedures

In this article I lay bare ISO 27001:2022 Annex A 5.37 Documented Operating Procedures.

Using over two decades of experience on hundreds of ISO 27001 audits and ISO 27001 certifications I am going to show you what’s new, give you templates, show you examples and do a walkthrough.

In this ISO 27001 certification guide I show you exactly what changed in the ISO 27001:2022 update. 

I am Stuart Barker the ISO 27001 Ninja and this is ISO 27001:2022 Annex A 5.37 Documented Operating Procedures.

What is ISO 27001 Documented Operating Procedures?

ISO 27001:2022 Annex A 5.37 Documented Operating Procedures is an ISO 27002:2022 control that wants you to document pretty much everything. It wants documented procedures for information processing facilities but take this as you will need to document all processes and procedures.

What is the purpose of ISO 27001:2022 Annex 5.37?

The purpose of ISO 27001:2022 Annex A 5.37 Documented Operating Procedures is to ensure the correct and secure operation of information security processing facilities. It is about process maturity. Having a documented process that is repeatable and if repeated the results would be consistent. It isn’t saying you are not doing it. It is saying, document it.

What is the definition of ISO 27001:2022 Annex 5.37?

The ISO 27001:2022 standard defines ISO 27001:2022 Annex A 5.37 Documented Operating Procedures as:

Operating procedures for information processing facilities should be documented and made available to personnel who need them. 

ISO 27001:2022 Annex A 5.37

ISO 27001 Documented Operating Procedures Implementation Guide

The headline guidance is, document all of your process and procedures. Do it to a level that is appropriate to you. Consider documenting common exception steps or steps in the process when the process does not go as intended.

When to document procedures

All the time. But for guidance the standard gives examples such as

  • when a procedure is performed by many people and needs to be done in the same way
  • when something is performed rarely and can be forgotten when it is needed again
  • when you do something new and if not done correctly it will create a risk
  • before someone else is taking on the procedure

What to document

The list is long. Take every process that you do for information security and document it. The standard provides examples, they are basically the processes and procedures of the standard. If you want the bare minimum then let me indulge you.

  • Specify who is responsible
  • document secure installation and configuration
  • document processing and handling of information, include manual and automatic methods
  • document backups and resilience
  • document scheduling requirements
  • document interdependencies between systems
  • document instructions for handling errors
  • document support and escalation contacts
  • document storage media handling
  • document restart and recovery procedures
  • document the management of audit logs, system logs, video monitoring, audit trails
  • document capacity management
  • document maintenance

Update procedures

Update and review procedures as needed but at least annually. The standard does not say at least annually. But it will catch you out if you do not.

Authorise changes to procedures

When you change something that change needs to be authorised with some evidence that the authorisation took place.

FREE 30 minute ISO 27001 strategy session.

Claim your 100% FREE no-obligation 30 minute strategy session call (£1000 value). This is strictly for small businesses who are hungry to get ISO 27001 certified up to 10x faster and 30x cheaper.

ISO27001 Certification Stragey Call

ISO 27001 Documented Operating Procedures Templates

Having an ISO 27001 template for control 5.37 can help fast track your implementation. The ISO 27001 Document Toolkit is a the ultimate resource for your ISO 27001 implementation.

Do it yourself

SAVE over £10,000

What are the Benefits of ISO 27001 5.37 Documented Operating Procedures?

Other than your ISO 27001 certification requiring it, the following are the top 5 benefits of ISO 27001:2022 Annex A 5.37 Documented Operating Procedures: 

  1. You cannot get ISO 27001 certification without it.
  2. Improved security: You will have an effective information security implementation that is based on documented processes that are repeatable and measurable
  3. Reduced risk: You will reduce the information security risks by having documented procedures that you and others follow
  4. Improved compliance: Standards and regulations require you to have documented operating procedures
  5. Reputation Protection: In the event of a breach having a documented operating procedures in place will reduce the potential for fines and reduce the PR impact of an event

Why is ISO 27001 Annex A 5.37 Documented Operating Procedures important?

The main reason it is important is because it gives maturity to processes. Having them documented and approved will allow consistency of operation. It will aid the communication of what is expected of people. It will address the requirements of the ISO 27001 standard.

Matrix of ISO 27001:2022 Controls and ISO 27001:2022 Attribute values

Control typeInformation
security properties
Cybersecurity
concepts
Operational
capabilities
Security domains
#Preventive
#Corrective
#Availability
#Confidentiality
#Integrity
#Protect
#Recover
#Asset_management
#Physical_security
#System_and_network_security
#Application_Security
#Secure_configuration
#Identity_and_access_management
#Threat_and_vulnerability_management
#Continuity
#Information_security_event_management

#Governance_and_ecosystem
#Protection
#Defence

Reference

ISO/IEC 27001 Information Security Management

ISO 27001 Templates Toolkit Business Edition Black
ISO27001 Policy Templates Pack Green

FREE 30 minute ISO 27001 strategy session.

Claim your 100% FREE no-obligation 30 minute strategy session call (£1000 value). This is strictly for small businesses who are hungry to get ISO 27001 certified up to 10x faster and 30x cheaper.

ISO27001 Certification Stragey Call

Shopping Basket