IT Operations Manual: Template for IT Documentation in Your Company

The BSI requires that administrative activities be traceable, meaning it is recorded what was changed, who did it and when (OPS.1.1.2.A5), that a deputy with the necessary knowledge and rights be named for each administrative task (OPS.1.1.2.A2), and that patches and changes be planned, approved and documented (OPS.1.1.3.A1). For data backup, plans must be created for each system covering scope, restoration order, retention and protection (CON.3.A4). The operations manual brings this information together for day-to-day work; the emergency manual under DER.4.A1 contains roles, immediate measures, alerting and recovery plans for emergencies.

The modules come from the IT-Grundschutz-Kompendium, Edition 2023. The BSI is replacing the Kompendium with Grundschutz++; according to the milestone plan, the methodology is to be published on October 27, 2026. The documentation and evidence requirements used here remain useful in substance.

Record the components according to the structure analysis in BSI Standard 200-2: business processes and applications, IT systems, rooms and communication networks (ch. 8.1). A network diagram shows at least IT systems such as clients, servers, switches, routers, Wi-Fi access points and network printers, the network connections between them and the external connections, such as internet connections (ch. 8.1.4). Keep it in electronic form and compare it with the actual IT. A detailed inventory can be kept separately; here, what operations needs is sufficient.

• Do not write passwords in this manual. According to the BSI, a password may only be written down for emergency deposit and must then be stored securely; the use of a password manager should be considered (ORP.4.A8).
• Assign roles exclusively for administration, according to actual need and with the least privileges necessary (OPS.1.1.2.A21).
• Each person administers with their own ID; logins with administrative IDs are logged (OPS.1.1.2.A5).
• When a person’s administrative task ends, their rights are revoked, personal administrative accounts are disabled and passwords known to them are changed (OPS.1.1.2.A4).

As the minimum content of the documentation, the BSI specifies which changes were made when, by whom and for what reason, and whether and why there was any deviation from specified standards or configurations (OPS.1.1.2.A11). Major changes are planned and approved in advance, with a fallback solution (OPS.1.1.3.A1).

TOMORIS recommendation: for each contract, record whether a data processing agreement (DPA) under Art. 28 GDPR is in place, and enter notice periods in a calendar. Prices belong in the contract files, not in the manual.

• Reference to the emergency manual with roles, immediate measures, alerting and recovery plans (DER.4.A1)
• Order in which systems and applications are restored, aligned with the backup plans (CON.3.A4)
• Alternative for central administration tools, such as a jump host or direct access to the systems (OPS.1.1.2.A27)
• Ensured for each administrative activity that it can also be carried out in an emergency if needed (OPS.1.1.2.A7)
• Emergency access deposited and stored securely, location noted in Part 3 (ORP.4.A8)
• Manual accessible even in an emergency, for example as a current printout or on separate storage (cf. DER.4.A1 for the emergency manual)

1. 1

   Update with every change

   New systems, service providers, roles or procedures are recorded in the manual in the same work step, not later.

2. 2

   Review regularly

   Go through it completely at least once a year and after major restructuring; rules for administrative activities should be updated regularly and whenever there is cause (OPS.1.1.2.A7).

3. 3

   Version and approve

   Version number, date and approval in Part 1; keep older versions so that changes can be traced.

4. 4

   Control access

   The manual contains sensitive information about your IT. Read access only for the people who need it; store the offline copy securely.