ISO 27001 A.5.37: written procedures, explained for startups

A.5.37 Documented operating procedures

Routine and recovery tasks follow written steps anyone on the team can use. What proves it: written procedures for key operational tasks, each with an owner and a review date.

A certification auditor samples runbooks for key operations. A file that usually does the job: runbooks for deployment, backup restore and user offboarding in your wiki, each with an owner and review date.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.5.37 walks you through it in this order.

1. Write short runbooks for the tasks that matter most: deploys, restores, onboarding and offboarding.
2. Give each an owner and keep them where the team works.
3. Review them once a year and after incidents.

No question in the readiness assessment covers A.5.37 directly, so the control card is its whole evidence path.

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Information Security Policy covers A.5.37. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criterion that cover this ground: CC5.3, policies and procedures.

Organizational controls

A.5.37 is one of the 37 organizational controls in Annex A. How the company runs security: policies, roles, suppliers, incidents, continuity and legal duties. Most of these are written decisions and the records that show you follow them.

Nearby controls in the same theme:

• A.5.34, personal data protection
• A.5.35, independent security review
• A.5.36, checking policy compliance

Before it: A.5.36, checking policy compliance. After it: A.6.1, background screening. Every control, by theme, is on the Annex A controls page.