Documented operating procedures

Plain-language summary

Writing down the procedures for operating information processing facilities — from server and network administration to backups, scheduled jobs and recovery — and making them available to the people who need them, so critical operations do not live in one person's head.

What the clause is really asking

If your network administrator resigned tomorrow, could someone else restart the systems, restore a backup or run the month-end jobs? This control asks you to write down how your information processing facilities are operated and to put those procedures in the hands of the people who need them. Typical procedures cover installation and configuration of systems; processing and handling of information, automated and manual; backup and restore; scheduling and dependencies between jobs; handling errors and exceptional conditions; support and escalation contacts, including suppliers; restart and recovery after failure; media handling; log management and monitoring; and maintenance. Procedures should be approved, kept current through change management, and written for the person who has to follow them. They matter most when an activity is done rarely, by different people, or across several sites. The common misunderstanding is that vendor manuals are the procedures; they describe the product, not your configuration of it. ISO 9001 practitioners already know the discipline from work instructions under 7.5 and controlled conditions under 8.5.1, and the same approach applies to IT operations.

What auditors look for

Auditors ask which IT operations are critical and request the procedures for two or three of them: backup and restore, a server or firewall change, month-end processing, setting up a new user. They check the procedures are approved, current and accessible to the people who use them, including when systems are down. They interview an administrator, ask them to show where the procedure is and walk through it, and compare the written steps with what they describe. They look for procedures updated after the last related change. The hard question: who else can do this task if the person who normally does it is unavailable?

Typical evidence

Index of documented operating procedures with owner, version and review date; procedures for backup and restore, system start-up and shutdown, user administration, scheduled jobs, patching and monitoring; offline or printed copies for use during recovery; change records showing procedure updates; access arrangements for the personnel who need them; training or sign-off records.

How to comply — recommendations

List the IT operations that are critical, risky or done rarely, and for each write a procedure of one to three pages in the format you already use for ISO 9001 work instructions: purpose, prerequisites, steps, checks, rollback, contacts. Start with backup and restore, joiners and leavers, patching, firewall changes and system recovery. Store them in your controlled document system, with an offline copy for use when systems are down. Make updating the procedure a closing step of every change request. Once a year, ask a second person to follow each critical procedure as a test, and fix whatever they stumble on.

Common nonconformities

Critical IT operations undocumented and dependent on one person; procedures out of date after system changes; procedures not accessible during an outage; vendor manuals used in place of procedures for the organisation's own configuration; procedures not approved or version-controlled; outsourced IT provider's procedures never seen or agreed.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• ArticleDocument control for ISO 9001: numbering, versions and approvals
• ArticleThe ISO 9001 document numbering system, explained (with examples)
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free downloadMaster Document RegisterThe register at the centre of document control: every controlled document with its number, owner, current revision, status and next review date.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free demoDocument-control demoA live register, revisions, approvals and an audit pack — no sign-up.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.