--- title: "ISO 27001: 2022 A.5.37 Documented operating procedures" description: "This article provides additional information on how you can meet the requirement for the ISO 27001: 2022 A.5.37 Documented operating procedures." --- [Skip to content](https://knowledge.adoptech.co.uk/5.37-documented-operating-procedures#main-content) [![Adoptech-logo-GreyWithoutStrapline-1.png\]](https://knowledge.adoptech.co.uk/hs-fs/hubfs/Adoptech-logo-GreyWithoutStrapline-1.png?height=39&name=Adoptech-logo-GreyWithoutStrapline-1.png)](https://knowledge.adoptech.co.uk/?hsLang=en) Open main navigation Close main navigation Adoptech Help Centre - There are no suggestions because the search field is empty. 1. [Knowledge base](https://knowledge.adoptech.co.uk/?hsLang=en) 2. [Frameworks & Certifications](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en) 3. [ISO 27001](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#iso-27001) # ISO 27001: 2022 A.5.37 Documented operating procedures ## This article provides additional information on how you can meet the requirement for the ISO 27001: 2022 A.5.37 Documented operating procedures. ### **ISO 27001: 2022 Control Description** Operating procedures for information processing facilities shall be  documented and made available to personnel who need them. ### Purpose To ensure the correct and secure operation of information processing facilities. ### Guidance Documented procedures should be prepared for the organisation’s operational activities associated with information security, such as: a) when the activity needs to be performed consistently by many individuals; b) when the activity is infrequent and may be forgotten by the time it is next performed; c) when the activity is new and presents a risk if not performed correctly; d) before handing over the activity to new personnel. The operating procedures should specify: a) the responsible individuals; b) the secure installation and configuration of systems; \]c) the processing and handling of information, both automated and manual; d) backup and resilience; e) scheduling requirements, including interdependencies with other systems; f) instructions for handling errors or other exceptional conditions (e.g. restrictions on the use of utility programs that may arise during job execution); g) support and escalation contacts, including external support contacts for unexpected operational or technical difficulties; h) instructions for handling storage media; i) system restart and recovery procedures for use in the event of system failure; j) the management of audit trail and system log information, and video monitoring systems; k) monitoring procedures such as capacity, performance, and security; l) maintenance instructions. Documented operating procedures should be reviewed and updated as necessary. Changes to documented operating procedures should be authorised. Where technically feasible, information systems should be managed consistently using the same procedures, tools, and utilities. - [Getting Started](https://knowledge.adoptech.co.uk/getting-started?hsLang=en#main-content) - [Getting Started](https://knowledge.adoptech.co.uk/getting-started?hsLang=en#getting-started) - [Accounts & Billing](https://knowledge.adoptech.co.uk/getting-started?hsLang=en#accounts-billing) - [FAQ's on Adoptech](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#main-content) - [Frameworks](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#frameworks) - [Policies & Documents](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#policies-documents) - [Risk Management](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#risk-management) - [Supplier Management](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#supplier-management) - [Audit Preparation](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#audit-preparation) - [Trust Centre](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#trust-centre) - [User Management](https://knowledge.adoptech.co.uk/faqs-on-adoptech?hsLang=en#user-management) - [Frameworks & Certifications](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#main-content) - [ISO 27001](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#iso-27001) - [ISO 42001](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#iso-42001) - [Cyber Essentials](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#cyber-essentials) - [CAF](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#caf) - [PCI-DSS](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#pci-dss) - [SOC2](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#soc2) - [Data Privacy (GDPR)](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#data-privacy-gdpr) - [DORA](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#dora) - [ISO 9001](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#iso-9001) - [ISO 22301](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#iso-22301) - [ISO 14001](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#iso-14001) - [NIST 800-53](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#nist-800-53) - [NIST-CSF](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#nist-csf) - [NIS2](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#nis2) - [ISO 20000-1](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#iso-20000-1) - [HIPAA](https://knowledge.adoptech.co.uk/frameworks-certifications?hsLang=en#hipaa) - [Integrations](https://knowledge.adoptech.co.uk/integrations?hsLang=en#main-content) - [Cloud Infrastructure](https://knowledge.adoptech.co.uk/integrations?hsLang=en#cloud-infrastructure) - [Identity & Access](https://knowledge.adoptech.co.uk/integrations?hsLang=en#identity-access) - [DevOps & Code](https://knowledge.adoptech.co.uk/integrations?hsLang=en#devops-code) - [Project Management](https://knowledge.adoptech.co.uk/integrations?hsLang=en#project-management) - [HR & People Systems](https://knowledge.adoptech.co.uk/integrations?hsLang=en#hr-people-systems) - [Security & Devices](https://knowledge.adoptech.co.uk/integrations?hsLang=en#security-devices) - [Communication & Collaboration](https://knowledge.adoptech.co.uk/integrations?hsLang=en#communication-collaboration) - [Legal & Regulations](https://knowledge.adoptech.co.uk/legal-regulations?hsLang=en) - [Security Guidance](https://knowledge.adoptech.co.uk/security-guidance?hsLang=en) - [Troubleshooting](https://knowledge.adoptech.co.uk/troubleshooting?hsLang=en) [![Chill listening crop-3](https://knowledge.adoptech.co.uk/hs-fs/hubfs/adoptech-logo-1.png?width=209&height=54&name=adoptech-logo-1.png "Chill listening crop-3")](https://adoptech.co.uk/) Copyright © 2026, Adoptech Ltd.