Measure · ISO 27001
Maintain operating procedures with your systems
Connect usable operating instructions, ownership and secure configuration to the existing service. Add only missing information.
Reuse existing records
Reuse service records, configuration profiles, jobs and operational records. The policy holds shared requirements; the service procedure describes their specific execution.
What to do
- 1
Connect inventory and ownership
Choose a related service or site from the existing inventory. Check ownership, versions, dependencies and protection requirements. Link usable existing procedures. Prioritise rare or risky activities, tasks performed by several people and handovers to substitutes.
- 2
Complete executable instructions
Add only missing details to the service: roles, prerequisites, secure setup, execution, expected results, timing dependencies and error handling. Include necessary backup, media, restart, logging, monitoring and maintenance steps. Keep approved secure configuration baselines authoritative there and reference access, information handling, deletion, change and recovery rules.
- 3
Implement endpoint and malware protection
Define approved settings for each device group and implement them: permitted software and updates, access and locking, network connections, risk-appropriate encryption, backup and necessary restrictions on local or removable storage. For permitted personal devices, follow the authoritative BYOD rules on separation and authority. Implement current malware protection for relevant endpoints, servers and file, mail or web paths. Check protection status and a suitable harmless test alert. Justify technically necessary exceptions with approval, alternative protection and review; reuse reporting and recovery procedures.
- 4
Check usability and actual state
Ask an authorised substitute to find and follow the workflow. Check availability for the intended failure scenario. Compare actual configuration with the approved baseline and handle differences in the existing operational record. Authorise changes and review procedures when needed. A second inventory or separate record for every step is unnecessary. Keep configuration versions, material changes and dependencies traceable in the protected existing inventory. Review regularly and after new versions or threats, updating relevant profiles. Users know safe handling and how to report suspicious files, theft or loss.
Worked example
An infrequent recovery task
Fictional example: A substitute needs to restart interrupted processing safely.
- Restart
- DecisionThe procedure identifies prerequisites, dependent services, steps, success checks and an escalation contact.
- EvidenceAccessible authorised version and a traceable application check in the existing operational record.
Record the result
- Current accessible procedure with necessary execution and error-handling details.
- Checked usability, actual configuration and authorised changes.
Common implementation mistakes
Treating a general policy as a runbook
The policy does not replace system parameters and executable steps for the service. Reference the authoritative rule and add only specific execution details.
Reuse the implementation across requirements
The references below show which requirements the measure contributes to.
View controls and standards
- A.5.37 · Dokumentierte BetriebsverfahrenGerman guide
Existing procedures are completed for necessary activities, kept accessible, checked in use and updated under control.
- A.8.9 · KonfigurationsmanagementGerman guide
Secure baselines and actual configurations are connected to existing systems. Technical enforcement and correction remain operational work.
- A.8.1 · EndbenutzergeräteGerman guide
The workflow connects device inventory with permitted use, implemented secure settings, protection, user awareness and loss or incident reporting. BYOD follows the authoritative rules.
- A.8.7 · Schutz vor SchadsoftwareGerman guide
Safeguards are implemented and kept current and functional across actual devices and transfer paths. User awareness, justified exceptions and response procedures complement software.
