Key takeaways
- Leadership sets an information security policy that suits the organisation, includes objectives (or a framework for them), and commits to meeting requirements and improving.
- The policy sets direction and commitment for the whole ISMS.
- Start here: write a policy suited to your purpose, with objectives or a framework for setting them.
Purpose
Leadership sets an information security policy that suits the organisation, includes objectives (or a framework for them), and commits to meeting requirements and improving.
Requirement
Requirement summaryTop management shall establish an information security policy that: a) is appropriate to the purpose of the organization; b) includes information security objectives (see 6.2) or provides the framework for setting information security objectives; c) includes a commitment to satisfy applicable requirements related to information security; d) includes a commitment to continual improvement of the information security management system. The information security policy shall: e) be available as documented information; f) be communicated within the organization; g) be available to interested parties, as appropriate.
Why it matters
The policy sets direction and commitment for the whole ISMS.
How to implement
- Write a policy suited to your purpose, with objectives or a framework for setting them.
- Include commitments to meet requirements and continually improve.
- Have top management approve it.
- Communicate it internally and make it available to interested parties as appropriate.
What evidence you need to provide
Here is what you will typically need to provide for Clause 5.2. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your information security policy, including a commitment to meet requirements and keep improving.
Records and examples to show
- Proof the policy was approved and dated by management.
- Proof it was shared with staff and made available to interested parties where appropriate.
Things you should be able to show or explain
- Staff should be able to say where the policy is and what it means for them.
How much to show: The policy plus a handful of staff.
Common mistakes
- Policy never shared.
- Policy doesn't match how the business actually works.
- A policy missing the required commitments.
- Policy published but never communicated.
- Tip: Get one senior sponsor who genuinely cares. It makes everything else easier.
Policies & documents to have
- Information Security Policy and topic-specific policies
FAQ
Can we exclude clause 5.2?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
An approved, communicated policy that staff know about.