Solutions The best route to security compliance
Platform A powerful suite of ISMS features
Resources Everything you need to know
Knowledge Base Learn more about infosec
Company Security and customers first

ISO 27001 Clause 5.2: Policy

Read the requirements of ISO 27001 Clause 5.2: Policy, which requires the organisation to establish an information security policy in a way that aligns with organisational goals and more.

An information security policy is the foundation of any ISMS.

The policy must outline the organisation’s objectives for security and provide supporting documents (i.e. procedures and guidelines) to achieve it. From providing the best route for achieving the ISMS goals to resolving any dispute that may occur during the implementation of the ISMS, a policy can be drafted to cover everything related to information security. The requirements for policy-making differ greatly, depending on the size and operation of the organisation, and must be tailored to the specifics of the organisation involved.

According to the standard, top management must establish the policy in a way that:

  1. Ensures the information security policy is highly tailored to the organisation –the policy should be tailored and specific to the business, rather than a standard, one-size-fits-all policy;
  1. Aligns with organisational goals – the information security policy must be in line with an organisation’s specific goals and strategies;
  1. Provides the objectives and framework for information security, presented in a clear and obvious way;
  1. Satisfies the requirements for information security and constant improvement of the ISMS, and this ongoing improvement is crucial for any successful ISMS;
  1. Communicates the contents of the policy to the rest of the organisation and other interested parties effectively.

The standard also requires the organisation to keep the policy in a document form, which is communicated within the organisation and available for interested parties.