Skip to content
Organisational controls
ISO 27001A.5.37

ISO 27001 Annex A 5.37 Documented operating procedures for information processing

What it says

Operating procedures for information processing facilities shall be documented and made available to personnel who need them.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure procedures are written down and accessible to those who need them.

Imagine running a business where no one knows exactly how to do their job because the instructions aren't written down. This control is basically saying: 'Let's not leave things to chance!' By documenting how information is processed, you ensure everyone knows what to do and how to do it, reducing mistakes and making sure everything runs smoothly.

Why it matters

Without documented operating procedures, staff run processing tasks inconsistently, increasing outages, data handling errors and inability to repeat or audit processing steps.

How to implement

  1. The IT manager should take the lead in documenting procedures for all key information processing activities.

    They can start by listing frequent, rare, and new activities, ensuring every procedure is written down so it can be consistently followed.

  2. HR should ensure that new staff receive and understand these documented procedures as part of their onboarding process.

    This can be done by integrating these procedures into training sessions and making sure they're easily accessible.

  3. Department heads should be responsible for keeping procedure documents up-to-date and relevant.

    They can do this by regularly reviewing the procedures, especially after changes in systems or regulations, to ensure they remain accurate.

  4. An operations manager should oversee the secure handling and storage of these documents.

    This includes setting up a digital library that is backed up regularly, ensuring easy access for authorised personnel only, aligned with the ASD Essential Eight.

  5. The compliance officer should verify that procedures include specific details like handling errors and correct sequences of tasks.

    They can do this by cross-referencing the procedures with actual practices, ensuring compliance with the Australian Privacy Act 1988.

Keep it running

Maintain version-controlled operating procedures for each processing facility; assign owners, review after changes/incidents, and publish them where relevant staff can easily access.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The documented operating procedures for all key information processing activities.

    Look at

    Whether each procedure is clearly written, relevant, and accessible to required personnel.

    Good evidence

    A comprehensive set of current documents available to everyone who needs them.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Records of when procedures were last reviewed and updated.

    Look at

    Timestamps and authorisation signatures on these records to see if reviews occur regularly. GOOD means procedures are reviewed regularly, and any updates are well-documented and authorised.

  3. Check 3 of 5What an auditor asks for

    Ask for

    To see training records for new staff on these procedures.

    Look at

    Whether there is evidence that all relevant personnel received proper training. GOOD will have everyone equipped with what they need to follow the procedures correctly from day one.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Evidence of how exceptions or errors are handled following documented procedures.

    Look at

    Examples of error logs or incident reports referencing applicable procedures. GOOD reflects consistent handling of issues as outlined in the procedures.

  5. Check 5 of 5What an auditor asks for

    Ask for

    How changes to procedures are communicated to staff.

    Look at

    Communication logs, emails, or memorandum updates that are sent when procedures are updated. GOOD means there's a clear, documented process for communicating changes promptly to everyone involved.

Mappings

Closest match in ASD Information Security Manual: ISM-0042, Maintain effective system administration practices, which this control covers in full and more.

ASD ISM

ASD Information Security Manual: 7 mappings

  • ISM-0042Maintain effective system administration practicesBroader than
  • ISM-0206Develop and maintain cable labelling processesBroader than
  • ISM-0348Develop and maintain media sanitisation proceduresBroader than
  • ISM-0576Develop and maintain cyber security incident plansPartially overlaps
  • ISM-0888Annual review of cyber security documentationPartially overlaps
  • ISM-0912Establish and manage system configuration changesPartially overlaps
  • ISM-1602Ensure cyber security docs are communicatedPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.

Get help with this control

ISO 27001 training

Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.