Discuss your project

TOOLBOX · DOWNLOAD

IT operationsmanual as atemplate.

If only one person knows how the IT runs, every vacation, every resignation and every outage is a risk. An IT operations manual records which systems exist, who looks after them and who deputizes, which procedures recur, what has been changed and whom to contact. This template provides an outline with tables to fill in. It is based on the BSI modules on proper IT administration, patch and change management, and data backup, the structure analysis according to BSI Standard 200-2 and the business continuity management module.

Download PDF (8 pages)What Is Inside

Free PDF · Template

IT Operations Manual: Template for IT Documentation in Your Company

Topic
IT Operations & Organization
Format
PDF, A4
Length
8 pages
Size
101 KB
Updated
Oct 25, 2026
Sources
7
Usage
Adaptation for your own use permitted; redistribute unchanged
Read as a Web Page

WHO IT IS FOR

Who This
Is for.

Outline with tables to fill in for systems, access, procedures, changes, contracts and emergencies, backed by BSI IT-Grundschutz and BSI Standard 200-2.

  • IT managers and administrators of small and medium-sized companies
  • IT service providers who manage and document their customers’ IT
  • Management that wants to reduce dependence on individual people
  • Information security officers who need evidence for audits

9 SECTIONS

What Is
Inside.

Every technical statement in the document names its source. The revision date appears on every page.
  • 01

    What an IT operations manual is for

    What documentation the BSI requires in IT operations and how the manual differs from the emergency manual.

  • 02

    Part 1: General information and responsible persons

    Scope, responsibilities with deputies and information on maintaining the manual.

  • 03

    Part 2: System overview

    Which systems, applications and services exist, what they are used for and what they depend on.

  • 04

    Part 3: Roles and access

    Who administers what, with which role, and where the credentials are stored, without stating them here.

  • 05

    Part 4: Recurring procedures

    What needs to be done on a recurring basis, how often, by whom and how it is documented.

  • 06

    Part 5: Change and administration log

    Every change with date, person, content and reason, as OPS.1.1.2.A11 specifies as the minimum content.

  • 07

    Part 6: Contracts, suppliers and support channels

    Whom to contact, what has been contractually agreed and when contracts end.

  • 08

    Part 7: Emergency and recovery

    What the operations manual provides for emergencies and what it refers to.

  • 09

    Maintaining the manual

    So that the manual helps when it is needed; TOMORIS recommendation.

EXCERPT

What an IT operations manual is for

The BSI requires that administrative activities be traceable, meaning it is recorded what was changed, who did it and when (OPS.1.1.2.A5), that a deputy with the necessary knowledge and rights be named for each administrative task (OPS.1.1.2.A2), and that patches and changes be planned, approved and documented (OPS.1.1.3.A1). For data backup, plans must be created for each system covering scope, restoration order, retention and protection (CON.3.A4). The operations manual brings this information together for day-to-day work; the emergency manual under DER.4.A1 contains roles, immediate measures, alerting and recovery plans for emergencies.

Outline of this template and its basis
PartContentBasis
1 GeneralScope, responsible persons, deputies, version and storageOPS.1.1.2.A2, A7
2 System overviewSystems, purpose, location, responsible persons, dependencies, network diagramBSI Standard 200-2, ch. 8.1
3 Roles and accessAdministrative roles, persons, location of credentialsOPS.1.1.2.A21, A23; ORP.4.A8
4 Recurring proceduresPatches, data backup, restore test, users, monitoringOPS.1.1.3.A15; CON.3.A5, A15
5 Change logWho changed what, when and for what reasonOPS.1.1.2.A11; OPS.1.1.3.A11
6 Contracts and supportSuppliers, services, support channels, termsTOMORIS recommendation
7 EmergencyReference to the emergency manual, recovery, alternative accessDER.4.A1; CON.3.A4; OPS.1.1.2.A27

The modules come from the IT-Grundschutz-Kompendium, Edition 2023. The BSI is replacing the Kompendium with Grundschutz++; according to the milestone plan, the methodology is to be published on October 27, 2026. The documentation and evidence requirements used here remain useful in substance.

Get the Full PDF

SOURCES

Supported
by Sources.

  1. BSI IT-Grundschutz-Kompendium, module OPS.1.1.2 Proper IT Administration, Edition 2023 (opens in a new tab)A2, A4, A5, A7, A11, A21, A23, A26, A27
  2. BSI IT-Grundschutz-Kompendium, module OPS.1.1.3 Patch and Change Management, Edition 2023 (opens in a new tab)A1, A11, A15
  3. BSI IT-Grundschutz-Kompendium, module CON.3 Backup Concept, Edition 2023 (opens in a new tab)A4, A5, A15
  4. BSI IT-Grundschutz-Kompendium, module ORP.4 Identity and Access Management, Edition 2023 (opens in a new tab)A8 rules for password use
  5. BSI IT-Grundschutz-Kompendium, module DER.4 Business Continuity Management, Edition 2023 (opens in a new tab)A1 creating an emergency manual
  6. BSI Standard 200-2: IT-Grundschutz Methodology (opens in a new tab)Ch. 8.1 structure analysis, 8.1.4 network diagram survey
  7. BSI: Grundschutz++, milestone plan (as of October 2026) (opens in a new tab)Replacement of the Kompendium

Adapt this template to your company: systems, roles, procedures and intervals depend on your IT and your protection needs. It is a TOMORIS recommendation based on the BSI sources cited.

TOOLBOX

Explore
Further.

IT OPERATIONS & ORGANIZATION

More on
This Topic.

More free PDFs about IT Operations & Organization.
All IT Operations & Organization Downloads

YOUR NEXT STEP

From Paper
to Practice.

We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.

Discuss ImplementationAll Downloads