Requirement
"Operating procedures for information processing facilities shall be documented and made available to personnel who need them."[1]
Explanation
Repeatable processes are required for a mature cybersecurity program. Documented IT and security standard operating procedures help demonstrate a mature information security program. Examples of topics covered by standard operating procedures are user onboarding change controls and media sanitation.
