ISO 27001 Annex A 5.37Documented Operating Procedures for Information Processing
Official control statement
Operating procedures for information processing facilities shall be documented and made available to personnel who need them.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Ensure procedures are written down and accessible to those who need them.
What this means in practice
Imagine running a business where no one knows exactly how to do their job because the instructions aren't written down. This control is basically saying: 'Let's not leave things to chance!' By documenting how information is processed, you ensure everyone knows what to do and how to do it, reducing mistakes and making sure everything runs smoothly.
Framework
ISO/IEC 27001:2022
Control effect (Control Stack)
Preventative
ISO 27001 domain
Organisational controls
Classifications
N/A
Official last update
24 Oct 2022
Control Stack last updated
29 Sept 2026
Why it matters
Without documented operating procedures, staff run processing tasks inconsistently, increasing outages, data handling errors and inability to repeat or audit processing steps.
Operational notes
Maintain version-controlled operating procedures for each processing facility; assign owners, review after changes/incidents, and publish them where relevant staff can easily access.
Implementation tips
- The IT manager should take the lead in documenting procedures for all key information processing activities. They can start by listing frequent, rare, and new activities, ensuring every procedure is written down so it can be consistently followed.
- HR should ensure that new staff receive and understand these documented procedures as part of their onboarding process. This can be done by integrating these procedures into training sessions and making sure they're easily accessible.
- Department heads should be responsible for keeping procedure documents up-to-date and relevant. They can do this by regularly reviewing the procedures, especially after changes in systems or regulations, to ensure they remain accurate.
- An operations manager should oversee the secure handling and storage of these documents. This includes setting up a digital library that is backed up regularly, ensuring easy access for authorised personnel only, aligned with the ASD Essential Eight.
- The compliance officer should verify that procedures include specific details like handling errors and correct sequences of tasks. They can do this by cross-referencing the procedures with actual practices, ensuring compliance with the Australian Privacy Act 1988.
Audit / evidence tips
- AskThe documented operating procedures for all key information processing activitiesLook atWhether each procedure is clearly written, relevant, and accessible to required personnelGoodA comprehensive set of current documents available to everyone who needs them
- AskRecords of when procedures were last reviewed and updatedLook atTimestamps and authorisation signatures on these records to see if reviews occur regularly. GOOD means procedures are reviewed regularly, and any updates are well-documented and authorised
- AskTo see training records for new staff on these proceduresLook atWhether there is evidence that all relevant personnel received proper training. GOOD will have everyone equipped with what they need to follow the procedures correctly from day one
- AskEvidence of how exceptions or errors are handled following documented proceduresLook atExamples of error logs or incident reports referencing applicable procedures. GOOD reflects consistent handling of issues as outlined in the procedures
- AskHow changes to procedures are communicated to staffLook atCommunication logs, emails, or memorandum updates that are sent when procedures are updated. GOOD means there's a clear, documented process for communicating changes promptly to everyone involved
Cross-framework mappings
How Annex A 5.37 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ASD ISM
| Control | Notes | Details |
|---|---|---|
open_in_fullBroader than(3)expand_less | ||
| ISM-0042 | Annex A 5.37 requires operating procedures for information processing facilities to be documented and made available to personnel who nee... | |
| ISM-0206 | ISM-0206 requires documented and maintained cable labelling processes and supporting procedures | |
| ISM-0348 | ISM-0348 requires organisations to develop, implement, and maintain media sanitisation processes and supporting procedures | |
sync_altPartially overlaps(4)expand_less | ||
| ISM-0576 | Annex A 5.37 requires operational procedures for information processing to be documented and made available to relevant personnel | |
| ISM-0888 | Annex A 5.37 requires operating procedures for information processing facilities to be documented and made available to personnel who nee... | |
| ISM-0912 | Annex A 5.37 requires documented and accessible operating procedures for information processing facilities | |
| ISM-1602 | ISM-1602 requires cyber security documentation, including change notifications, to be communicated to stakeholders | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ISO 27001 controls in Organisational controls
See all Organisational controls controls, or browse the full ISO 27001 library. You can also track all 93 controls with the free ISO 27001 Annex A checklist.
Want to implement this control?
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.