[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-37":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-37","Annex A 5.37","Documented operating procedures",0,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Document operating procedures for information processing facilities and make them available to the people who need them.\n\n**In practice.** Key operational activities, such as system start-up and shutdown, backup and restore, patching, user provisioning, monitoring and handling of failures, have written procedures or runbooks. They name owners, are version controlled, reviewed when systems change and stored where operators can reach them, including during an outage. Automation scripts and infrastructure as code can serve as procedures when they are documented and controlled. Auditors sample procedures, check that they match current practice and confirm review dates.\n\n**Common gaps.** Procedures are commonly out of date or exist only in the heads of a few senior engineers. Runbooks stored solely on the systems they describe become unavailable exactly when they are needed most.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]