ISO/IEC 27017:2026
Organizational controls, cloud service specific guidance – ISO/IEC 27017:2026

ISO/IEC 27017:2026 5.37: Documented operating procedures

What does 5.37 require?

Carried from the first-edition CLD control on administrator operational security: administrative operations of the cloud environment are to be defined, documented and watched. The CSC documents critical operations whose failure could do irreparable damage, such as installing, changing or deleting virtualised servers, networks and storage, terminating cloud service use, and backup and restoration, with a supervisor monitoring them; the CSP gives CSCs who need it documentation of critical operations and procedures. Because rapid, self-service administration by staff on both sides can cause serious incidents through human error, such as erasing or shutting down many virtual servers, safeguards for these operations should be considered and applied where needed.

Maintained by Gerard Blokdyk

Other controls in Organizational controls, cloud service specific guidance – ISO/IEC 27017:2026

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.