Operating Procedure

Go up to Terms and Definitions

An Operating Procedure specifies how an operator or system performs an operation under identified conditions.

An Operating Procedure identifies the applicable sequence of activities, responsibilities, inputs, outputs, controls, decision points, records, and completion criteria. Its scope depends upon the operation and the environment in which the operation occurs.

Environment-specific Operating Procedures address conditions associated with Connected Environments, Disconnected Environments, and Air-Gapped Environments.

An Operating Procedure differs from a requirement. A requirement states a necessary outcome, behavior, characteristic, or constraint. An Operating Procedure specifies the activities used to conduct an operation.

a specified way to carry out activities associated with the operation of a system or environment

Adapted from the ISO definition of procedure: “specified way to carry out an activity or a process.”

International Organization for Standardization, “Techniques and Schemes”

See also ISO 9000:2015, *Quality management systems — Fundamentals and vocabulary*, definition 3.4.5.

An Operating Procedure may address:

• Preconditions
• Assigned responsibilities
• Required resources
• Ordered activities
• Authorization and security controls
• Decision and exception paths
• Required records and Evidence
• Completion and acceptance criteria
• Recovery or rollback activities

The procedure’s medium does not determine the concept. Text, workflow definitions, checklists, scripts, executable automation, or combinations of these forms express an Operating Procedure.

A Connected Environment Operating Procedure identifies the authorized External Network Connections and External Services used during a DIDO-TE test. It also specifies approval, monitoring, recording, exception handling, and Evidence-preservation activities.