All 93 controls · Organizational controls
Control 5.37
Documented operating procedures
What ISO/IEC 27002:2022 control 5.37 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Procedures for operating information processing facilities are to be written down and made available to the staff who need them. Purpose: make information processing facilities run correctly and securely. Guidance: document procedures for security-related operational activities, for example when many people must do the task the same way, when it is done so rarely that people will have forgotten how, when it is new and risky if done wrongly, or before it is handed to new staff. Procedures should state who is responsible; how systems are securely installed and configured; how information is processed and handled automatically and manually; backup (8.13) and resilience; scheduling needs and dependencies on other systems; how to deal with errors and exceptional conditions during jobs, including limits on utility programs (8.18); who to call for support or escalation, including outside suppliers, for unexpected operational or technical problems; storage media handling (7.10, 7.14); restart and recovery after system failure; management of audit trails and system logs (8.15, 8.17) and of video monitoring (7.4); monitoring of capacity, performance and security (8.6, 8.16); and maintenance. Procedures are reviewed and updated as needed, changes to them are authorized, and where technically possible systems are run consistently with the same procedures, tools and utilities.
Purpose in the standard’s terms, in our words: Ensures information processing facilities are operated correctly and securely.
Attribute values in one line: Preventive, Corrective; Confidentiality, Integrity, Availability; Protect, Recover; Asset management, Physical security, System and network security, Application security, Secure configuration, Identity and access management, Threat and vulnerability management, Continuity, Information security event management; Governance and ecosystem, Protection, Defence.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | PreventiveCorrective |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | ProtectRecover |
| Operational capabilities | Asset managementPhysical securitySystem and network securityApplication securitySecure configurationIdentity and access managementThreat and vulnerability managementContinuityInformation security event management |
| Security domains | Governance and ecosystemProtectionDefence |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- Documented operating procedures for security-relevant activities, available to the personnel who perform them
- Procedures covering installation and configuration, backup, scheduling, error handling, escalation contacts, media handling, restart and recovery, log management, monitoring and maintenance
- Version history showing authorized changes and periodic review of procedures
- Evidence that rarely performed or newly introduced activities have written procedures
- Handover records showing procedures were provided to new personnel
- Evidence that systems of the same type are managed with the same procedures and tools
Where audits commonly find gaps
- Procedures exist only in the heads of experienced administrators
- Documents are outdated and do not match current systems
- Recovery and restart procedures are missing for critical systems
- Changes to procedures are made without any authorization
What ISO/IEC 27028 changes for this control
It carries more than one control type (preventive, corrective), so the register should record each and the evidence that proves each one operates. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 9 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (12.1.1) is kept in the register so an older audit file can still be traced. It serves more than one security domain, which is why a domain count taken by row understates the view.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.