Policy Register
Every policy type · Operations and technology

Documented operating procedures

The step-by-step instructions for operating each system and process, available to the people who run them.

How the register reads it

Also calledSOPs, runbooks, work instructions
FamilyOperations and technology
Document typeProcedure. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Expected ownerThe head of IT operations.
Review cadenceAnnual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list whenISO 27001 is ticked and no line resolves to it (DORA requires it too, inside a parent document, so it does not list it separately).
TemplateNo template yet. The clauses below say what the document is expected to contain.

Which standards require it, and what each expects it to contain

2 requiring clauses, 2 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 5.37 Documented operating procedures

Document operating procedures for information processing facilities and make them available to those who need them.

What the ISO 27002 guidance expects the document to say: Requires the operating procedures used to run information processing facilities to be written down and made available to the personnel who need them.

Evidence an auditor accepts: The set of documented operating procedures for information processing facilities, covering routine operation, backup, monitoring, incident handling and restart; evidence procedures are available to the personnel who need them, including during an outage of the primary system that hosts them; version control and review records, showing procedures are current against the systems they describe
Common gap: outdated procedures still in use
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

DORA (Regulation (EU) 2022/2554)

DORA Art. 9 Protection and prevention

Financial entities shall continuously monitor and control the security and functioning of ICT systems and tools, and minimise ICT risk through appropriate ICT security policies, procedures, protocols and tools ensuring resilience, continuity and availability, and preserving confidentiality, integrity and authenticity of data (incl access management, encryption, secure configuration, network security).

Evidence an auditor accepts: ICT security policies and protective controls (access, encryption, configuration, network); evidence preserving CIA of data
Common gap: Weak or absent protective controls
Source: DORA (Regulation (EU) 2022/2554)

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Database security standard · Email and messaging policy