Why it matters
Undocumented procedures mean security depends on one person remembering how something works.
How a self-led small team implements it
Write down the procedures for your highest-risk or most error-prone tasks first; you don't need every process documented on day one.
What auditors expect to see
Procedure documents for key operational tasks.
Track A.5.37 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS