---
notetype: reference
standard: ISO 27002
version: 2022
language: EN
type: control
id: "A.5.37"
title: "Documented operating procedures"
theme: Organizational
control_type:
  - Preventive
  - Corrective
information_security_properties:
  - Confidentiality
  - Integrity
  - Availability
cybersecurity_concepts:
  - Protect
  - Recover
operational_capabilities:
  - Asset_management
  - Physical_security
  - System_and_network_security
  - Application_security
  - Secure_configuration
  - Identity_and_access_management
  - Threat_and_vulnerability_management
  - Continuity
  - Information_security_event_management
security_domains:
  - Governance_and_Ecosystem
  - Protection
  - Defence
tags:
- iso27002/2022/EN
- sourcetext
status: active
---

## 5.37 Documented operating procedures

### Control
Operating procedures for information processing facilities should be documented and made available to personnel who need them.

### Purpose
To ensure the correct and secure operation of information processing facilities.

### Guidance
Documented procedures should be prepared for the organization’s operational activities associated with information security, for example:

a\) when the activity needs to be performed in the same way by many people;

b\) when the activity is performed rarely and when next performed the procedure is likely to have been forgotten;

c\) when the activity is new and presents a risk if not performed correctly;

d\) prior to handing over the activity to new personnel. 

The operating procedures should specify:

a\) the responsible individuals;

b\) the secure installation and configuration of systems;

c\) processing and handling of information, both automated and manual;

d\) backup (see [8.13](a-8.13-Information-backup.md)) and resilience;

e\) scheduling requirements, including interdependencies with other systems;

f\) instructions for handling errors or other exceptional conditions \[e.g. restrictions on the use of utility programs (see [8.18](a-8.18-Use-of-privileged-utility-programs.md))\], which can arise during job execution;

g\) support and escalation contacts including external support contacts in the event of unexpected operational or technical difficulties;

h\) storage media handling instructions (see [7.10](a-7.10-Storage-media.md), [7.14](a-7.14-Secure-disposal-or-re-use-of-equipment.md));

i\) system restart and recovery procedures for use in the event of system failure;

j\) the management of audit trail and system log information (see [8.15](a-8.15-Logging.md), [8.17](a-8.17-Clock-synchronization.md)) and video monitoring systems (see [7.4](a-7.4-Physical-security-monitoring.md));

k\) monitoring procedures such as capacity, performance and security (see [8.6](a-8.6-Capacity-management.md), [8.16](a-8.16-Monitoring-activities.md));

l\) maintenance instructions.

Documented operating procedures should be reviewed and updated when needed. Changes to documented operating procedures should be authorized. Where technically feasible, information systems should be managed consistently, using the same procedures, tools and utilities.

### Other information
No other information.