ISO 27002:2022, Control 5.37 – Documented Operating Procedures

General Guidance on Control 5.37

Procedures should be created for information security-related activities in accordance with 5 key operational considerations:

1. Any instance of an activity that is performed by one or more people, in the same way.
2. When an activity is not often carried out.
3. When a procedure carries the risk of being forgotten.
4. Any new activities that are unfamiliar to staff, and are therefore subject to a higher degree of risk.
5. When the responsibility for carrying out an activity is transferred to a different employee or group of employees.

Where these instances occur, documented operating procedures should clearly outline:

1. Any individuals responsible – both incumbents and new operators.
2. A set of guidelines that maintain security during the installation and subsequent configuration of any related business systems.
3. How information is processed throughout the activity.
4. BUDR plans and implications, in the event of data loss or a major event (see Control 8.13).
5. Linked dependencies with any other systems, including scheduling.
6. A clear procedure for dealing with “handling errors” or miscellaneous events that have the potential to occur (see Control 8.18).
7. A full list of personnel to be contacted in the event of any disruption, including clear escalation procedures.
8. How to operate any relevant storage media associated with the activity (see Controls 7.10 and 7.14).
9. How to reboot and recover from a system failure.
10. Audit trail logging, including all associated event and system logs (see Controls 8.15 and 8.17).
11. Video monitoring systems that monitor onsite activities (see Control 7.4).
12. A robust set of monitoring procedures that cater to the operational capacity, performance potential and security of said activity.
13. How the activity should be maintained, in order to be kept at optimal performance levels.

All of the above procedures should be subject to periodic and/or ad-hoc reviews, as and when required, with all changes being ratified by Management in a timely manner to safeguard information security activity across the organisation.

Changes and Differences From ISO 27002:2013

27002:2022-5.37 replaces 27002:2013-12.1.1 (Documented operating procedures).

27002:2022-5.37 expands on 27002:2013-12.1.1 by offering a much broader set of circumstances that would warrant adherence to a document procedure.

27002:2013-12.1.1 lists information processing activities such as computer start-up and close-down procedures, backup, equipment maintenance, media handling, whereas 27002:2022-5.37 expands the remit of the control to generalised activities not limited to specific technical functions.

Aside from a few minor additions – such as categorising the individuals responsible for an activity – 27002:2022-5.37 contains the same general guidance points as 27002:2013-12.1.1

How ISMS.online Helps

ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process, from defining the scope of your ISMS through risk identification and control implementation.

• Users can complete tasks and submit evidence to demonstrate compliance with the standard.
• It’s easy to delegate responsibilities and monitor progress towards compliance.
• The extensive risk assessment toolset saves time and effort throughout the process.
• We have a dedicated team of consultants on hand to support you throughout your journey to compliance.

Get in touch today to book a demo.