Measure · ISO 27001
Create and communicate your information security policy
Set out what information security must achieve for your organisation, who is responsible and how you will improve it. Use the editable template to record top management's direction.
Reuse existing records
Update an existing suitable policy. Keep objectives and actions in their existing records. Maintain working rules and information classes in the relevant topic policies and link to them here.
What to do
- 1
Adapt the principles to your organisation
Agree with top management which services and information need protection. Record the scope, the framework for security objectives, responsibilities and the commitments to meet applicable requirements and improve the ISMS. The policy sets the direction. Topic policies such as "Working securely" and "Protecting information" contain the detailed rules. Link to your own current documents.
- 2
Approve it and explain what it means
Have top management approve the adapted version and make it available at its authoritative location. Explain the relevant principles to the people concerned and answer questions. Record their understanding and commitment to comply in a way appropriate to their role. Give relevant external interested parties a suitable version without disclosing confidential information.
- 3
Keep the policy current
Assign an owner and a suitable review interval. Also review the policy when significant changes occur in the business, requirements or risks. Consider lessons from incidents, audits and management reviews. Obtain approval for changes, check affected topic policies for conflicts and communicate the relevant changes. Use your existing document and task management.
Worked example
Update an existing policy for a new service
An IT service provider brings a new customer service into its ISMS scope.
- Business purpose and responsibility
- DecisionTop management updates the business purpose, confirms responsibilities and approves the new version. The teams concerned receive the relevant changes.
- EvidenceApproved document version and communication through the existing team or briefing process.
Record the result
- Current policy with approval, ownership and working references to your own topic policies.
- Communication and acknowledgement of the relevant principles in the existing briefing process. The next review is recorded against the document or as an existing task.
Common implementation mistakes
The template is left unchanged
Complete the marked fields and check that responsibilities and references work in practice. Remove the editing guide before organisational approval.
Rules are maintained in several places
Maintain device and reporting rules in the employee policy, and classification and handling in the information protection policy. The overarching policy links to these authoritative sources.
Related requirement
The references below show which requirements the measure contributes to.
View controls and standards
- A.5.1 · InformationssicherheitsrichtlinienGerman guide
The measure produces an overarching policy that is defined, approved, communicated and reviewed. The necessary topic policies and their implementation still require separate work.
Resources for your next step
- Information security policy template
Editable DOCX and ODT files with a PDF for viewing. The editing guide follows the cover and explains every field to adapt.
- Edit and approve policies in Kopexa
Organise collaboration, approval of a specific version and periodic reviews against the document.