The written steps that carry out a policy. It names who does what, in order, and it produces the records your assessment relies on.
Also called procedures, standard operating procedure.
Practitioner Guidance
What it means in practice
A procedure turns a policy into steps someone can follow.
It names the trigger, the person, the steps in order, and the record produced at the end. That last part is what makes procedures matter for an assessment. A procedure that produces no record leaves you with nothing to show, however well it is written.
Design the procedure around the record it creates.
An account request procedure that ends in an approved ticket gives you evidence for several assessment objectives at once, starting with AC.L2-3.1.1. The same procedure conducted verbally gives you none. When you write a procedure, ask what will exist afterwards that proves it happened.
Your people are interviewed, so the procedure must describe what they really do.
Assessors interview the person who performs the work, not only the person who wrote the document. Where the two disagree, the assessor believes the interview. Write the procedure by watching the work, then change the work where it needs changing, rather than writing an aspiration and hoping.
Name a person or a role, never the company.
A step that says the organization reviews access leaves nobody accountable and produces no record. A step that says the operations lead reviews access each quarter and files the list produces both. Small companies do this well when they stop copying language written for large ones.
What falls short
A procedure that stops before the record. The record is what the assessment examines.
A procedure describing a tool you no longer use. Retire it, because a stale document is tested against the current system.
Steps written in the passive voice with no owner. Somebody must be named.
Edge cases
One person performs every step. Say so honestly, and add a documented check by a second person where a requirement expects separation.
A provider performs the procedure. Record it in your system security plan, and hold the provider's record as your evidence.
The procedure runs rarely, such as an annual review. Keep the last completed record, because the interval you set is what you are held to.
Over-engineering
A formal document control system for a ten-person company. A dated file with an owner and a version is enough.
Diagramming every procedure. Numbered steps are read faster and are easier to keep current.