Applied AI & Cybersecurity
ISO 27001 information security policy: what clause 5.2 requires and how to write one
What the standard requires of the policy, how it differs from topic-specific policies and procedures, how to draft and review it, and what auditors check.
Every great mission starts with reconn.
The ISO/IEC 27001 information security policy is the document in which top management sets the direction of the ISMS. Clause 5.2 says what it must contain: it must suit the purpose of the organization, include security objectives or a framework for setting them, and commit to meeting applicable requirements and to continual improvement. It must also be kept as documented information, communicated inside the organization and, where appropriate, available to interested parties.
The standard does not tell you how long it should be or what to call it. That is a judgment call, and it is where most policies go wrong. If you want to talk through yours, talk to me directly. There is no commitment.
Key takeaways
- Clause 5.2 sets seven requirements. Four are about content: suited to the organization's purpose, objectives or a framework for them, a commitment to satisfy applicable requirements, and a commitment to continual improvement. Three are about availability: documented, communicated and, as appropriate, available to interested parties.
- Top management establishes the policy. Annex A control 5.1 adds that it is approved by management, published, acknowledged by relevant personnel and interested parties, and reviewed at planned intervals and when significant changes occur.
- ISO/IEC 27002 separates the information security policy, which is high level and approved by top management, from topic-specific policies, which are detailed and approved at an appropriate level of management.
- Write the policy to say why and what, not how. The how belongs in procedures and in the topic-specific policies underneath.
- An auditor checks that the policy exists, and also whether people know it. Expect to be asked how it was communicated and how you know staff have read it.
- With reconn, self-paced eLearning includes a 1-on-1 session with a PECB Certified Trainer and unlimited email and WhatsApp support until you clear the exam.
Which PECB course fits your role?
Lead Implementer
Implement, run and improve an ISMS to ISO/IEC 27001.
For people who build and run the ISMS.
Lead Auditor
Plan, run and report an ISMS audit.
For people who audit it.
Chief Information Security Officer
Lead the information security program across the organization.
For people who lead security across the organization.
What ISO 27001 requires of the policy
Clause 5.2 is short, and every line of it can be tested in an audit. It starts by putting the job with top management: top management shall establish an information security policy. That fits with clause 5.1, where top management has to make sure the policy and the security objectives are established and are compatible with the strategic direction of the organization. If the standard itself is new to you, the ISO 27001 guide explains where leadership sits in the whole system.
| Requirement | What it means in practice |
|---|---|
| Appropriate to the purpose of the organization | It reflects what the organization does, how it works and what it has to protect. A policy copied from another company fails this on its first read |
| Includes objectives, or a framework for setting them | Either the policy states the security objectives, or it says how objectives are set. Clause 6.2 then requires the objectives to be consistent with the policy, measurable if practicable, monitored, communicated and kept as documented information |
| Commits to satisfy applicable requirements | A statement that the organization will meet its legal, regulatory, contractual and other security requirements |
| Commits to continual improvement of the ISMS | A statement that the ISMS will be improved over time, which clause 10 and management review then have to back up |
| Available as documented information | It exists in written form and is controlled under clause 7.5 |
| Communicated within the organization | People are told, and you can show how. Clause 7.3 expects persons doing work under the organization's control to be aware of the policy |
| Available to interested parties, as appropriate | Top management decides which interested parties need to see it, such as customers, suppliers or regulators |
What Annex A adds
Annex A control 5.1 asks for more than the clause does. The information security policy and the topic-specific policies must be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur. The word acknowledged matters. Sending an email is communication. A recorded acknowledgement is evidence.
If you are comparing the two documents, ISO 27001 vs ISO 27002 explains how the requirements standard and the guidance standard fit together.
From my side of the table. The clause does not say the policy must be signed. In practice, most auditors want to see a version, an owner, an approver and an approval date. That is how you prove top management established it, and it takes one line in the document control block.
Policy, topic-specific policies, procedures and guidelines
Candidates and clients mix these up constantly, and the mixing causes real audit findings. The information security policy is the top document. Beneath it sit the topic-specific policies, and beneath those sit procedures.
| Information security policy | Topic-specific policy | |
|---|---|---|
| Level of detail | General or high level | Specific and detailed |
| Approved by | Top management | An appropriate level of management |
ISO/IEC 27002 gives examples of topics that a topic-specific policy can cover: access control, physical and environmental security, asset management, information transfer, user endpoint devices, network security, incident management, backup, cryptography and key management, classification and handling of information, management of technical vulnerabilities, and secure development. It also says the organization can name these documents standards, directives, policies or something else, and that in some organizations the policy and the topic-specific policies can sit in a single document.
Policy or guideline?
A guideline is advice. A policy is a directive that people are expected to follow. Once you commit to the standard, the document in clause 5.2 has to be the second kind. Use wording such as must and shall where you mean it, and keep suggestions in guidelines that sit beside the policy.
What I tell candidates. I rarely see a client with no policy. I often see one with a long document that mixes the policy, the topic policies and half the procedures. Split it. A one or two page policy that top management can explain from memory is worth more than forty pages that nobody has read.
How to write one that holds up
Start from the inputs the guidance names. ISO/IEC 27002 says the policy should take into account the business strategy and requirements, regulations, legislation and contracts, and the current and projected information security risks and threats. It then lists what the policy should state.
- A definition of information security. In your own words, tied to confidentiality, integrity and availability.
- Objectives, or the framework for setting them. Put the objectives in the policy only if they are stable. Otherwise name the process and owner that sets them each year.
- Principles that guide security activity. The rules people apply when no procedure covers the situation.
- The commitment to meet applicable requirements. Name the types of requirement, such as legal, regulatory and contractual.
- The commitment to continual improvement. Tie it to your internal audit and management review cycle so it is more than a sentence.
- Assigned responsibilities. Give roles, not names, and make sure they match clause 5.3.
- How exemptions and exceptions are handled. Say who can approve one and how it is recorded.
Layout and drafting
A clear structure helps. Open with the administrative details: title, version, dates, owner and approver. Then add a short summary, the scope, the objectives, the principles, the responsibilities and the related policies. Definitions and the consequences of breaching the policy can go in where they help.
Draft each section in plain, accurate language and keep product names and operational detail out. Check the content against the standard and against your other policies, because two policies that contradict each other will be found. Then get it approved and communicate it. The policy answers why and what, and the procedures answer how.
In practice. Write for the newest employee, not for the auditor. If a person in their first week cannot tell from the policy whether sending a client file to a personal email address is acceptable, the policy is not doing its job. The auditor will ask that same question of staff in the audit.
Keeping the policy current
ISO/IEC 27002 asks for review at planned intervals and when significant changes occur. It lists the changes to look at: business strategy, the technical environment, regulations and contracts, risks, the threat environment, and lessons from incidents. The review should also take in the results of management reviews and audits, and when one policy changes, the related policies should be checked for consistency.
ISO/IEC 27001 does not set a fixed interval. Choose one you can keep, record it in the document control block, and make sure the management review under clause 9.3 actually looks at the policy.
A practitioner note. A policy with no review record is one of the easiest findings for an auditor to write. Put the review on the management review agenda as a standing item, and the evidence builds itself.
What an auditor will look for
A policy is easy to audit badly and hard to audit well. A good auditor tests whether the policy was established, implemented and communicated. They do not stop at the document. They interview people, then corroborate what they hear by checking training records for new employees, checking what existing employees understand about the policy and its general content, and checking communication logs to see whether it reached the relevant parties.
Expect the auditor to check each requirement of clause 5.2 against evidence. They will look for approval by top management, the objectives or the framework for them, the commitments, the documented form, proof of communication, and a record of how decisions on external availability were made. They will also check that the objectives under clause 6.2 are consistent with the policy.
If you want to learn to do this from the auditor's side, what the Lead Auditor certification is explains the credential.
Who should write it, and who should learn how
Top management has to own the policy, and someone with ISMS knowledge usually drafts it. In most organizations that is the security manager, the CISO or an external consultant. The Lead Implementer course covers policy development as part of building the whole system, and what the Lead Implementer certification is explains the credential. If your role is to assess policies and audit systems rather than build them, Lead Implementer vs Lead Auditor helps you choose.
If you would rather have the documentation built for you, reconn's ISO 27001 implementation services cover gap assessment, documentation, control mapping and audit support. For the path from policy to certificate, how to get ISO 27001 certification covers the steps.
Learning ISO 27001 with reconn
The PECB courseware and exam are the same through any authorized partner. The difference is who supports you. With reconn, I answer your questions myself. I am a PECB Certified Trainer with more than 20 years in cybersecurity.
- A 1-on-1 session with a PECB Certified Trainer, included with self-paced eLearning.
- Unlimited email and WhatsApp support, directly with the trainer, until you clear the exam, within your 12-month enrollment window.
- The chance to bring your own draft policy and ask what an auditor would say about it.
- Dedicated team batches live online or in a classroom, with corporate invoicing on request.
Packages and prices are on the Lead Implementer and Lead Auditor course pages. If you work in the Gulf, ISO 27001 Lead Auditor and Lead Implementer courses in the Middle East covers the local frameworks I can map to the standard.
Frequently asked questions
What does ISO 27001 clause 5.2 require in the information security policy?
The policy must be appropriate to the purpose of the organization, include security objectives or a framework for setting them, and include commitments to satisfy applicable requirements and to continually improve the ISMS. It must also be available as documented information, communicated within the organization and available to interested parties, as appropriate.
Who approves the information security policy?
Top management establishes it under clause 5.2, and ISO/IEC 27002 says top management should approve the policy and any changes to it. Topic-specific policies can be approved at an appropriate level of management.
What is the difference between an information security policy and a procedure?
The policy states direction and requirements at a high level, covering why and what. A procedure describes how a task is carried out. ISO/IEC 27002 also describes topic-specific policies, which sit between the two and cover a defined area in more detail.
How often should the information security policy be reviewed?
ISO/IEC 27001 does not set a fixed interval. Annex A control 5.1 asks for review at planned intervals and if significant changes occur, so you choose an interval, record it and review earlier after major changes.
Does the information security policy need to be public?
Not necessarily. Clause 5.2 requires it to be available to interested parties as appropriate, so top management decides who needs to see it. If it is shared outside the organization, it should not include confidential information.
Can one policy cover more than one management system?
The standards allow flexibility in format, and ISO/IEC 27002 notes that policies can sit in a single document. Keep the policy consistent with the policies of your other management systems, and keep it relevant to the ISMS.
Does the policy have to include the security objectives?
No. Clause 5.2 says it either includes the objectives or provides the framework for setting them. Clause 6.2 then requires the objectives themselves to be consistent with the policy and kept as documented information.
Do employees have to acknowledge the policy?
Annex A control 5.1 asks for the policy to be communicated to and acknowledged by relevant personnel and interested parties. Clause 7.3 separately requires people doing work under the organization's control to be aware of the policy.