We often get asked about how much detail is needed, and what areas of the business need to have documented procedures. It is important that documents are maintained in a correct and current state and should therefore be subject to formal change management and periodic review procedures – this is key, as the auditor will be specifically looking to see this.

In more traditional computing environments and architectures operating procedures are much more likely to be required. Where information systems are “cloud-based” traditional operational activities such as system start-up, shut-down, backup etc become less relevant and may often be outsourced to a cloud provider.

Documented operating procedures help to ensure consistent and effective operation of systems for new staff or changing resources, and can often be critical for disaster recovery, business continuity and for when staff availability is compromised.

Operating procedures must be documented and then made available to all users who need them. Lets understand those requirements and what they mean in a bit more depth now. It’s an important part of the information security management system (ISMS) especially if you’d like to achieve ISO 27001 certification. The objective of this Annex A area is to ensure correct and secure operations of information processing facilities. What is the objective of Annex A.12.1 of ISO 27001:2013?Īnnex A.12.1 is about Operational Procedures and Responsibilities. Please CLICK HERE to see the full revised ISO 27001 Annex A Controls to see the most up-to-date information. Please be aware that as of the 25th of October 2022, ISO 27001:2013 was revised and is now known as ISO 27001:2022.

Download Encrypt Care Pro 4.3 + Free