ISO 27001 A.5.37: Documented operating procedures

Start by identifying all information processing facilities and the operational activities that need documented procedures. Prioritise by criticality and complexity. Common areas include server and infrastructure management, network operations, database administration, backup and recovery, change management, patch management, user account management, security monitoring, log review, and incident response.

Create a standard template so all procedures have a consistent structure: purpose and scope, prerequisites and required access, step-by-step instructions, expected outcomes and verification steps, error handling and troubleshooting, escalation procedures, related references, version control information, and review schedule.

Write for the right audience - qualified personnel in the relevant role. You do not need to explain basic concepts, but the procedures should be specific enough that a competent person unfamiliar with your particular environment could follow them. Add screenshots, diagrams, or command examples wherever they add clarity.

Store everything in a centralised, accessible location - a wiki, knowledge base, or document management system. Make sure critical recovery procedures are available even during outages (keep offline copies). Use version control to track changes.

Assign an owner to each procedure. Review at least annually and whenever related systems or processes change. Test critical procedures periodically to confirm they still work. Remove or archive anything obsolete so people do not follow outdated instructions.

Embed procedures into daily operations. Reference them in work instructions and checklists. Include procedure compliance in operational audits. Where possible, turn procedures into runbooks or automation scripts so they are built into the tooling rather than sitting in a document nobody reads.