ISO 27001:2022 Requirements: Clause 5.2 Information Security Policy

An information security policy is the foundation of any ISMS.

The policy must outline the organisation’s objectives for security and provide supporting documents (i.e. procedures and guidelines) to achieve it. From providing the best route for achieving the ISMS goals to resolving any dispute that may occur during the implementation of the ISMS, a policy can be drafted to cover everything related to information security. The requirements for policy-making differ greatly, depending on the size and operation of the organisation, and must be tailored to the specifics of the organisation involved.

According to the standard, top management must establish the policy in a way that:

• Ensures the information security policy is highly tailored to the organisation –the policy should be tailored and specific to the business, rather than a standard, one-size-fits-all policy;
• Aligns with organisational goals – the information security policy must be in line with an organisation’s specific goals and strategies;
• Provides the objectives and framework for information security, presented in a clear and obvious way;
• Satisfies the requirements for information security and constant improvement of the ISMS, and this ongoing improvement is crucial for any successful ISMS;
• Communicates the contents of the policy to the rest of the organisation and other interested parties effectively.

The standard also requires the organisation to keep the policy in a document form, which is communicated within the organisation and available for interested parties.