T3.2.2 - DOCUMENTED OPERATING PROCEDURES Implementation Guidance
The entity shall document operating procedures.
Back to T3.2.2 - P3 - DOCUMENTED OPERATING PROCEDURES
Documented procedures should be prepared for system activities associated with information processing and communication systems, such as computer start-up and close-down procedures, back- up, equipment maintenance, media handling, computer room and mail handling management, and safety.
The operating procedures should specify the instructions for the detailed execution of each job including:
- A. Processing and handling of information
- B. Backup
- C. Scheduling requirements, including interdependencies with other systems, earliest job start and latest job completion times
- D. Instructions for handling errors or other exceptional conditions, which might arise during job execution, including restrictions on the use of system utilities
- E. Support contacts in the event of unexpected operational or technical difficulties
- F. Special output and media handling instructions, such as the use of special stationery or the management of confidential output including procedures for secure disposal of output from failed jobs
- G. System restart and recovery procedures for use in the event of system failure
- H. The management of audit-trail and system log information
Operating procedures, and the documented procedures for system activities, should be treated as formal documents and changes authorized by management. Where technically feasible, information systems should be managed consistently, using the same procedures, tools, and utilities
