Policy

Plain-language summary

A short, top-level statement of what information security means for your organisation and what leadership commits to — appropriate to your purpose, including or framing your objectives, promising to meet applicable requirements and to keep improving — communicated inside and available to interested parties as appropriate.

What the clause is really asking

The policy is the ISMS's constitution, not its rulebook. The clause asks for a document that fits the organisation's purpose (a logistics firm and a software house should not have the same policy), that either states the information security objectives or gives the framework for setting them, that commits to satisfying applicable requirements (legal, regulatory, contractual) and to continual improvement, and that is documented, communicated within the organisation and available to interested parties as appropriate — customers and regulators increasingly ask for it. It should be one to two pages. The detailed topic-specific policies (acceptable use, access control, cryptography, remote working and so on) belong under Annex A control 5.1, not here; confusing the two produces a 40-page 'policy' nobody reads. ISO 9001 holders will recognise the structure exactly.

What auditors look for

Auditors read the policy for the four required elements and then test communication: they ask staff at random what the policy says and where to find it, and ask how a new employee meets it. They check the approval signature and date against the management-review record that approved or re-approved it, and whether it was reviewed after major change (new business line, a serious incident). They ask how it is made available to interested parties — on request, on the website, in the customer portal — and whether the objectives in 6.2 can be traced back to it.

Typical evidence

Approved and dated information security policy with the four required elements; evidence of communication (induction content, intranet, posters, awareness session records); evidence it was reviewed at planned intervals; a record of how it is made available to interested parties; objectives that visibly derive from it.

How to comply — recommendations

Write one page: why information security matters to this organisation, the commitments (meet our legal and contractual requirements, protect confidentiality, integrity and availability, manage risk, keep improving), the framework for objectives, who is accountable and where to report concerns. Have the chief executive sign it, put the review date on it, and publish it where people already look — the intranet landing page and the induction pack. Keep the detailed rules in separate topic policies that reference it. Reuse your quality policy's approval and communication process if you have one; the mechanics are identical.

Common nonconformities

Policy missing one of the required elements (objectives framework, commitment to applicable requirements, commitment to improvement); generic template policy not appropriate to the organisation's purpose; staff unaware of the policy or where to find it; policy unsigned, undated or not reviewed in years; policy conflated with the detailed topic-specific policies; not available to interested parties who have asked for it.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Free downloadInformation Security Policy templateThe clause 5.2 policy on one page: what you commit to, the objectives framework, who does what, the rules in brief, communication and review — with «fields» to fill and a box on how to keep it true.
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.