ISO27001 Annex A 5.1 Policies Beginner’s Guide

ISO27002: 2022 Clause 5.1 Policies

In this article I lay bare ISO27001 Annex A 5.1 / ISO27002:2022 Clause 5.1 Policies.

A beginners guide, exposing the insider trade secrets, giving you the templates that will save you hours of your life and showing you exactly what you need to do to satisfy it for ISO27001 certification. We show you exactly what changed in the ISO27001:2022 update. I am Stuart Barker the ISO27001 Ninja and this is ISO27001 Annex A 5.6

What is ISO27001 Annex A 5.1?

ISO27001 Annex A 5.1 Information Security Policies is an ISO27002: 2022 control that requires an organisation to have an information security policy and topic specific policies in place, communicated, reviewed and acknowledged.

I like this change from the old ISO27001: 2013 version as it calls out explicitly now that a pack or suite of policies will be required rather than just the headline information security policy.

ISO27001 Annex A 5.1 Definition

The ISO27001 standard defines ISO27001 Annex A 5.1 Information Security Policies as:

Information security policy and topic-specific policies should be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur.

ISO27001 Annex A 5.1

ISO27001 Annex A 5.1 Implementation Guide

You are going to have to

• work out what policies you actually require
• write them
• sign them off
• publish them
• have them acknowledged by staff
• review them at regular intervals

The absolute best way to do this is download the prewritten ISO27001 Policy Pack and follow the guide on How To Implement Policies.

If you are resolutely dead set on going through the pain of this yourself you are going to need copies of the relevant standards for information security, about 1 to 2 months of your life dedicated to this and a lot, and I mean a lot, of patience.

ISO27001 Annex A 5.1 Templates

If you want to write these yourself I totally commend you. And pity you in equal measure. There are over 25 information security policies and you can could save months of effort with these templates that take 25 years of experience and distill it in a pack of prewritten best practice awesomeness.

How to comply with ISO27001 Annex A 5.1

To comply with ISO27001 Annex A 5.1 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to

• Write an information security policy
• Supplement that information security policy with topic specific policies
• Ensure your policies are classified and have document mark up
• Have the policies approved by management and have evidence of that happening
• Publish the policies to a place everyone that needs to see them can see them
• Tell those people where those policies are
• Communicate your policies as part of your communication plan and document you did it
• Get people to acknowledge the policies and keep evidence that they have
• Plan to review your policies at least annually or if significant change occurs
• Keep records of your policy review and the changes

How to pass an audit of ISO27001 Annex A 5.1

To pass an audit of ISO27001 Annex A 5.1 you are going to make sure that you have followed the steps above in how to comply.

You are going to do that by first conducting an internal audit, following the How to Conduct an ISO27001 Internal Audit Guide.

What will an audit check?

The audit is going to check a number of areas. Lets go through them

#1 That you can link policy to requirements

What this means is that you need to show that your policies are linked

• to the business strategy (which you recorded and evidenced in your organisation overview document).

• to the law, regulations and contracts (which you recorded in the legal register).

• to risks (which you recorded in your risk register ).

#2 That your policy includes required statements

For the main information security policy there are some required statements that need to be included. You need to

• define information security and the confidentiality, integrity and availability definition
• include your information security objectives
• include principles that will guide on information security activities activities
• include a commitment to satisfy applicable requirements related to information security
• have a commitment to continually improving your information security management system
• assign responsibilities for information security management to defined roles
• cover how you handle exemptions and exceptions.

#3 That top management approved the policy

Top 3 Annex ISO27001 A 5.1 Mistakes People Make

The top 3 Mistakes People Make For ISO27001 Annex A 5.1 are

#1 You have no evidence that anything actually happened

You need to keep records and minutes of everything. You need a paper trail to show it was done. Make sure you have updated communication plans, minutes of meetings, records of acknowledgement, records of approval. If it isn’t written down it didn’t happen.

#2 One or more members of your team haven’t done what they should have done

Prior to the audit check that all members of the team have done what they should have. Do they know where the policies are? Have they acknowledged them? Did someone join last month and forget to do it? Check!

#3 Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

Why is ISO27001 Annex A 5.1 Important?

ISO27001 Annex A 5.1 Information Security Policies is important because people need to know what is expected of them. Policies are statements of what you do. They are not statements of how you do it. How you do it is covered in process documents.

The policies tell people what is expected of them and what they should do.

From a HR perspective you have no come back if someone does something wrong unless you have told them what they should do right and the consequences for getting it wrong.

If you don’t tell me, I don’t know.

No matter how simple, straightforward, obvious or common sense YOU think it is, someone, somewhere will disagree and there is nothing you can do about it unless you have told them.

ISO27001 Policies Ultimate Reference Guide

How to deploy and implement ISO27001 Policies Video Tutorial

ISO27001 Annex A 5.1 FAQ

Matrix of controls and attribute values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
#Preventive	#Confidentiality #Integrity #Availability	#Identify	#Governance	#Governance_and_Ecosystem #Resilience

See Also

• Guaranteed ISO27001 Certification up to 10x Faster and 30x Cheaper
• The Ultimate ISO27001 TOOLKIT so you can do it yourself 
• ISO27001 Exposed: The facts you must know (Not knowing these could cost you $10,000s!) 
• 25 Things You Must Know Before Going for ISO27001 Certification (Number 3 will blow your mind!)
• The Ultimate Reference Guide to ISO27001 Policies

Reference

ISO/IEC 27001 Information Security Management