How to Create Runbooks: A Small Business Guide

Consistency is a necessity when performing information technology (IT) tasks at your small business. Whether it's installing a software patch or responding to a server failure, IT procedures must be well documented to produce desired outcomes.

IT runbooks are the best method to achieve this consistency. We'll go over runbook basics, the differences between runbooks and playbooks, and how to create a runbook, so you can begin using this tool at your small business.

Overview: What is a runbook?

Each IT runbook documents an approved process, and IT system administrators and operators use runbooks, collected in catalogs, to ensure routines such as starting, supervising, debugging, and stopping a system are standardized.

With a runbook, whether a process is performed daily or once a year, an experienced employee and a new hire will complete it the same way.

Typical runbook catalogs address:

• System processes
• Security and access control
• System configuration
• Configuration management
• Monitoring and alerting
• Operational tasks
• Maintenance tasks
• Failure and recovery procedures

Runbooks are part of Information Technology Infrastructure Library (ITIL) protocols. The ITIL framework consists of best practices and checklists to integrate IT activities with overall business procedures and objectives.

Runbooks incorporate information from ITIL processes such as knowledge management and contribute to problem management.

Runbook automation (RBA) via IT management software allows you to create runbooks and perform them automatically, with human intervention occurring only at predetermined points.

This runbook combines automated tasks with human analysis. Image source: Author

A runbook catalog is like a cookbook: Each one is a collection of processes that includes lists of resources and procedures to produce predetermined outcomes, whether it's monitoring system performance or cooking an omelet.

Runbook vs. playbook: What's the difference?

Runbooks are often confused with playbooks -- some IT professionals use the terms synonymously -- but there are significant differences. While runbooks define individual processes, playbooks deal with overarching responses to larger issues or events and may incorporate multiple runbooks and personnel within them.

The security incident response playbook below includes runbook documentation, but its workflow has a wider scope than the runbook alone.

This security incident playbook incorporates relevant runbook documentation within its workflow. Image source: Author

If a runbook catalog is comparable to a cookbook, a playbook is like a guide to hosting different social events: a cocktail party, a wedding reception, or a formal dinner.

Each event includes food items -- hors d'oeuvres, a wedding cake, entrees, and desserts -- but the recipes, instead of standing alone, are part of a larger workflow: creating a guest list, formulating a menu, choosing music, and more, to create a unified social experience.

Types of runbooks

Runbooks come in two categories: general procedures and specialized procedures for specific events, service requests, or assets. Both types of runbooks may be:

• Manual: Step-by-step operator actions using IT tools
• Semi-automated: Operator actions combined with automated tasks
• Fully automated: No operator intervention

1. General runbooks

General runbooks include routine IT department activities such as a help agent responding to low-level IT tickets or a network administrator performing pre-scheduled tasks in your IT management software:

• Reviewing audit logs
• Performing daily backups
• Monitoring system performance

Documenting routine procedures makes new IT employee onboarding more efficient and promotes process consistency no matter who is performing tasks.

2. Specialized runbooks

Specialized runbooks document processes for more complex service requests or unplanned events, such as different disaster recovery scenarios. A detailed runbook for each situation reduces downtime and produces optimal results.

Specialized runbook topics include:

• Network failure
• Hardware failure
• Power outage
• Security breach
• Damage control

The worst time to create a specialized runbook is in response to a critical event. Be proactive to avoid the loss of time and money.

How to create a runbook for your small business

As you work through the five steps below to create your runbooks, keep the five As in mind:

• Actionable: Focus on defined actions, not theory.
• Accurate: Test and validate the content in each runbook.
• Authoritative: Have one runbook per process.
• Accessible: Make runbooks easily available.
• Adaptable: Review and update runbooks regularly.

Step 1: Plan

Careful planning is required to produce high-quality runbooks that provide the most help for day-to-day tasks and unexpected critical events.

Considerations include:

• Prioritize processes: Create your first runbooks for processes performed most frequently and with high error rates as well as events that pose the greatest operational and financial risks.
• Create a runbook template: Using a template ensures each runbook contains necessary information, including a process overview, process steps, technical documentation, personnel permissions and authorizations, escalation protocols, and required reporting and communications.

Each runbook must be comprehensive yet focused, and uniform content organization allows IT personnel to access information without delay.

Step 2: Research

Gather the necessary information for your runbook before you begin writing to streamline the writing process.

Information to generate includes:

• Procedures: Don't write out processes from memory; instead, work through the process while taking notes and capturing screenshots to document every step.
• Documentation: Include hardware and software technical specifications, configuration information, network diagrams, and login credentials.
• Alerts: Identify the alerts and notifications that result in using the runbook.
• Permissions: Determine who is authorized to use the runbook and/or has the permissions required to execute it.
• Communications: Set up necessary reporting guidelines for runbook initiation, completion, and after action review (AAR).

A runbook template aids the research process because you'll know up front what you need. You also avoid a start-and-stop writing process due to repeatedly backtracking to find yet another piece of critical information.

Step 3: Write

Documenting procedures may not be anyone's idea of a good time, but completing the previous two steps will make the process more efficient when you're ready to write.

Two helpful hints include:

• Identify missing information: Insert relevant information collected during the research phase into your runbook template, which also identifies missing content the runbook requires.
• Create a style guide: Create an editorial style guide detailing everything from standardized grammar to naming conventions to uniform jargon, to avoid potential confusion.

Another way to achieve clarity is to pair a technical writer with an IT subject matter expert (SME) instead of using only IT personnel to produce runbooks.

Step 4: Test

Everyone wants their first draft of a document to be the final version. Instead, conduct rigorous testing of completed runbooks to identify missing, incorrect, extraneous, or unclear content.

Two groups to use for testing are:

• In-house experts: Multiple in-house IT personnel should test each runbook for accuracy and relevance.
• New hires: Whether your new hires are IT newbies or old hands, their perspectives will offer useful input to avoid IT groupthink.

Collect feedback from those outside the runbook's operator procedures, such as upper-level supervisors and others who participate in authorization or communication processes.

Step 5: Update

Change is a constant inside IT departments and systems, so periodically evaluate and update your runbooks to maintain their applicability.

Two times to do this include:

• Post-incident reviews: Runbooks used in response to critical events or system failures must be assessed during your AAR to identify any necessary changes.
• System updates: Any changes to your hardware, software, or network require a careful evaluation of existing runbooks to make required updates.

Store your runbook documentation in a centralized repository for easy updating and so everyone uses the same versions.

Begin compiling your runbooks now

Runbooks ensure consistent, high-quality IT service delivery, whether it's a routine help desk ticket or an unexpected system failure. Producing runbooks is also a proactive strategy to minimize the loss of time and money due to critical events.