ISO 27001 Annex A 5.1 Policies for Information Security + Templates

ISO 27001 Policies for Information Security

In this ultimate guide to ISO 27001 Policies for Information Security, you will learn how to implement it, how to write your own polices and how to audit it without needing a consultant or compliance software. Includes free training video and templates.

What are ISO 27001 Policies?

ISO 27001 policies are statements of what you do for information security and are used to communicate to staff what must be done and to customers what you do.

Policies are a foundation stone of an information security management system. They are approved by senior management and outline an organisation’s approach to safeguarding sensitive data. Furthermore, they include both high-level and low-level guidelines, ensuring that all employees understand their responsibilities in maintaining data confidentiality, integrity, and availability. Subsequently, policy reviews, stakeholder communication, and a formal change management process are crucial for maintaining the effectiveness of this critical element of an organisation’s information security management system.

Basically they are intended to ensure the ongoing suitability, adequacy, and effectiveness of management direction and support for information security, aligning with all applicable business, legal, statutory, regulatory, and contractual requirements.

ISO 27001 Policy Templates

ISO 27001 policy templates are a fast track that are guaranteed to save you time and money. ISO 27001 Annex A 5.1 Policy templates are focused on the ISO 27001 Policies and having an ISO 27001 Policy Pack. The benefit of using the ISO 27001 policy pack is that the ISO 27001 templates are already fully populated and ready to go.

FREE Training Video

In this free training video you will learn How to implement ISO 27001 Policies for Information Security (Annex A 5.1) and Pass Your Audit

What is it?

ISO 27001 Annex A 5.1 Policies for Information Security is an ISO 27001 control that requires an organisation to have an information security policy and topic specific policies in place, communicated, reviewed and acknowledged.

I like this change from the old ISO 27001:2013 version as it calls out explicitly now that a pack or suite of policies will be required rather than just the headline information security policy.

Purpose

The purpose of the Annex A 5.1 Policies for Information Security is to ensure the suitability, adequacy and effectiveness of managements direction and support for information security.

Definition

ISO 27001 defines ISO 27001 Annex A 5.1 as:

Information security policy and topic-specific policies should be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur.

ISO 27001:2022 Annex A 5.1 Policies for Information Security

Reference Guide

In this ISO 27001 Policies Ultimate Guide I show you what the requirement is for ISO 27001 and the detailed requirements for the new ISO 27001 standard of controls.

The following is compliance guidance for Policies for Information Security.

Guidance

Organisations must have an information security policy approved by top management. This policy outlines the organisation’s approach to managing information security. Implementing ISO 27001 Annex A 5.1 requires a structured approach to defining, approving, and communicating the rules that govern your information security environment. This roadmap outlines a pragmatic process for implementing Annex A 5.1, ensuring a clear evidence trail for your auditor.

Senior leadership ownership

Designate the senior leadership team as the primary body responsible for developing, approving, and implementing information security policies. The result is a governance framework where policies carry sufficient corporate authority to drive compliance across all departments.

• Appoint a Policy Owner from the executive board to maintain ultimate accountability.
• Define the roles of the Senior Leadership Team in the formal approval process.
• Ensure resource allocation is provided for policy enforcement and monitoring.

Core policy requirements

Align the policy suite with specific business strategies, legal obligations, and security risks. The result is a robust set of rules that protects the organisation’s specific business needs while ensuring full compliance with relevant laws, regulations, and contracts.

• Map strategies to ensure security supports rather than hinders business growth.
• Integrate contractual obligations from enterprise clients into the policy language.
• Cross-reference the Risk Register to ensure policies address current and potential threats.

Comprehensive policy statements

Include clear statements that define information security and establish security objectives for the organisation. The result is a documented set of guiding principles and frameworks that commit the organisation to continuous improvement and clear responsibility mapping.

• Outline principles for all information security activities to ensure consistency.
• Establish procedures for handling exceptions to prevent security “shadow IT.”
• Include formal commitments to meeting all applicable statutory security requirements.

Topic specific policies

Develop detailed guidance for specific security controls such as Access Control, Physical Security, and Asset Management. The result is a modular policy architecture that supports the main information security policy with granular, actionable rules for technical teams.

• Provision specific policies for Network Security, Cryptography, and Data Classification.
• Ensure topic-specific rules align with Secure Development and Vulnerability Management.
• Establish clear directives for Device Security and Data Transfer to protect remote workers.

Top management approval

Obtain formal approval from top management for all primary policies and any subsequent changes. The result is a physical or digital evidence trail that satisfies ISO 27001 Clause 5.2 requirements for leadership commitment.

• Record approval in signed minutes of Information Security Management meetings.
• Utilise digital signatures for version control and non-repudiation.
• Ensure the CEO or equivalent role has personally validated the top-level policy.

Communicate and track acknowledgement

Disseminate policies to all personnel and stakeholders in an understandable format and require formal acknowledgement. The result is a legally defensible record that staff have read, understood, and agreed to comply with security mandates.

• Execute a communication plan that makes policies accessible via a central Intranet or portal.
• Redact or protect confidential information when distributing policies to external parties.
• Retain digital sign-off evidence through a Learning Management System or email confirmation.

Regular policy reviews

Review the policy set at planned intervals or following significant changes to technology or business strategy. The result is an adaptive ISMS that incorporates lessons learned from security incidents and findings from internal audits.

• Schedule annual reviews led by personnel with the necessary technical expertise.
• Assess policy relevance against evolving security risks and updated legal contracts.
• Ensure management reviews directly inform the policy update process for continual improvement.

Supplementary Guidance

Topic-specific policies can vary across organisations.

	Information security policy	Topic-specific policy
Level of detail	General or high-level	Specific and detailed
Documented and formally approved by	Top management	Appropriate level of management

How to implement it

Implementing this control requires a structured approach to writing and deploying policies and making sure that they are enforced. The high level implementation process is:

• work out what policies you actually require
• write them
• sign them off
• publish them
• have them acknowledged by staff
• review them at regular intervals

This roadmap outlines a pragmatic process for implementing Annex A 5.1, ensuring a clear evidence trail for your auditor.

Step 1: Determine Required Policies

Identify the policies your organisation requires based on your Statement of Applicability, business risks, and legal obligations. Avoid a “one-size-fits-all” approach; if you do not develop software, you do not need a secure development policy.

Step 2: Write the Policies

Draft the main policy and necessary topic-specific documents. Remember: policies state what you do, not how you do it (the “how” belongs in procedures). Keep them concise and principle-based.

Step 3: Assign Ownership

Designate an owner for every policy. While an Information Security Manager may draft the content, senior leadership must retain ultimate accountability to ensure the policy carries authority.

Step 4: Secure Management Approval

Crucial Step: Top management must formally approve all policies. Record this evidence in signed minutes of information security management meetings.

Step 5: Publish and Communicate

Publish policies in an accessible location (e.g., Intranet). Execute a communication plan to ensure all personnel are aware of the policies; a single email is insufficient.

Step 6: Get Acknowledgement

Retain evidence that personnel have read and understood the policies. Methods include email confirmations, signed forms, or LMS digital sign-offs.

Step 7: Schedule Regular Reviews

Review policies at planned intervals (at least annually) or upon significant changes (e.g., new technology or legal requirements). Document these reviews in version control logs.

Crafting Compliant Policies: Key Ingredients

To satisfy an auditor, your documents must contain specific content requirements mandated by the standard.

Mandatory Statements for the Main Policy

Your high-level policy must include:

• Definition of information security (Confidentiality, Integrity, Availability).
• Information security objectives or the framework for setting them.
• Guiding principles for security activities.
• Commitment to satisfy applicable legal, regulatory, and contractual requirements.
• Commitment to continual improvement of the ISMS.
• Assignment of responsibilities for security management.
• Process for handling exemptions and exceptions.

Examples of Topic-Specific Policies

Granular guidance is required for specific controls, such as:

• Access Control & Identity Management
• Asset Management & Data Classification
• Physical & Environmental Security
• Incident Management
• Cryptography & Key Management
• Secure Development & Vulnerability Management

Required Policies Checklist

Policy Name	Topic	Mandatory?
Information Security Policy	Strategy & Governance	✅ YES
Access Control Policy	Who gets in?	✅ YES
Supplier Security Policy	Vendor rules.	✅ YES
Acceptable Use Policy (AUP)	User behavior.	✅ YES
Clear Desk & Screen Policy	Physical security.	✅ YES
Backup Policy	Data recovery.	✅ YES

How to comply

To comply with ISO 27001 Annex A 5.1 Policies for Information Security you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to

• Write an ISO 27001 information security policy
• Supplement that information security policy with topic specific policies
• Ensure your policies are classified and have document mark up
• Have the policies approved by management and have evidence of that happening
• Publish the policies to a place everyone that needs to see them can see them
• Tell those people where those policies are
• Communicate your policies as part of your communication plan and document you did it
• Get people to acknowledge the policies and keep evidence that they have
• Plan to review your policies at least annually or if significant change occurs
• Keep records of your policy review and the changes

What the auditor will check

The auditor is going to check a number of areas for compliance with Annex A 5.1. Lets go through them

1. That you can link policy to requirements

What this means is that you need to show that your policies are linked

• to the business strategy, which you recorded and evidenced in the ISO 27001 organisation overview template.
• to the law, regulations and contracts , which you recorded in the ISO 27001 legal register.
• to risks, which you recorded in your ISO 27001 risk register.

2. That your policy includes required statements

For the main ISO 27001 information security policy there are some required statements that need to be included. You need to

• define information security and the confidentiality, integrity and availability definition
• include your information security objectives
• include principles that will guide on information security activities activities
• include a commitment to satisfy applicable requirements related to information security
• have a commitment to continually improving your information security management system
• assign responsibilities for information security management to defined roles
• cover how you handle exemptions and exceptions.

3. That top management approved the policy

The audit will look to see that the main ISO 27001 information security policy and the topic specific policies have been approved and signed off by top management. The level will have been defined in your ISO 27001 Roles and Responsibilities Template document in line with ISO 27001 Annex A 5.2 Roles and Responsibilities

How to Audit it

Auditing Annex A 5.1 requires a structured approach to verify that your policies are not just written, but actively communicated, enforced, and maintained. The audit process generally falls into three high-level phases:

1. Documentation & Governance Review: Verifying that the overarching Information Security Policy and supporting topic-specific rules align with your business context, are formally approved by top management, and are subject to strict version control and regular review cycles.
2. Communication & Exception Management: Inspecting dissemination channels (like intranets and LMS platforms) to ensure staff and third-party suppliers have acknowledged the rules, while reviewing the exception register to ensure deviations are justified and time-bound.
3. Technical Fieldwork & Enforcement: Conducting technical spot-checks (e.g., verifying password complexity) and staff interviews to prove “policy in practice,” alongside reviewing incident reports and corrective actions to measure the framework’s overall effectiveness.

The step by step audit process:

1. Formalise Policy Ownership and Accountability

Identify the designated owners for each security policy and verify that they possess the necessary authority and technical competence. Accountability ensures that policies are kept current and relevant to the evolving threat landscape.

• Verify that ownership is documented within the policy metadata or the Asset Register.
• Confirm that owners review policies at least annually or upon significant organisational change.
• Audit the link between policy ownership and internal IAM roles to ensure management oversight.

2. Validate Executive Approval and Commitment

Examine evidence that senior management has formally approved the information security policies. Without documented approval, policies lack the mandate required to enforce compliance across the organisation.

• Inspect meeting minutes from the ISMS Steering Committee or Board level.
• Ensure approval records include the specific version and date of the policy.
• Check that the “Top Management” signature is present on the primary Information Security Policy.

3. Audit Policy Communication and Accessibility

Determine how policies are distributed to employees and relevant third parties. A policy is only effective if it is accessible to those required to follow it, including contractors and external partners.

• Check the internal intranet or Document Management System for ease of access.
• Review onboarding records to ensure new starters acknowledge the policies.
• Verify that specific technical policies, such as Cryptography or Access Control, are shared with relevant technical teams.

4. Review Policy Maintenance and Update Cycles

Verify that the organisation has a defined schedule for reviewing policies. This step ensures that the ISMS reacts to new security threats, legislative changes, and technological advancements.

• Check the revision history for every core policy to confirm regular updates.
• Audit the process for “ad-hoc” reviews following a significant security incident.
• Cross-reference policy dates with the latest version of the ISO 27001 standard.

5. Evaluate Alignment with Risk Assessment

Ensure that the policies directly address the risks identified in the organisation’s Risk Treatment Plan. Policies should provide the high-level requirements that technical controls are built to satisfy.

• Compare the Access Control Policy against the current IAM role matrix.
• Verify that the Cryptography Policy reflects the sensitivity of data stored in the Asset Register.
• Check for a direct mapping between policy statements and identified business risks.

6. Audit Version Control and Integrity

Inspect the document control process to prevent the use of obsolete or unauthorised policy versions. Poor version control leads to conflicting instructions and security gaps.

• Confirm that only the latest approved version is available to the general workforce.
• Check that archived versions are stored securely to prevent accidental implementation.
• Verify that unique identifiers are used for every policy document.

7. Inspect Exception Handling and Non-Compliance

Examine the records of any policy exceptions. A robust audit must show that deviations from policy are documented, risk-assessed, and approved by the appropriate authority.

• Review the Exception Log for outdated or unreviewed policy bypasses.
• Check that exceptions have a defined expiry date and a plan for eventual remediation.
• Verify that non-compliance with policies triggers a formal disciplinary or corrective action process.

8. Assess Technical Control Mapping

Verify that the high-level policy requirements are actually implemented via technical configurations such as MFA or encryption. This bridges the gap between “paper compliance” and real security.

• Sample technical settings in the cloud environment to see if they match the Password Policy.
• Check that the Acceptable Use Policy (AUP) is reflected in web filtering categories.
• Review Right to Audit (ROE) clauses in supplier contracts to ensure policy alignment.

9. Monitor Training and Awareness Integration

Confirm that the contents of the security policies are integrated into the annual security awareness training. Employees should not just “read” policies but understand their practical application.

• Audit training modules for specific mentions of policy requirements.
• Check quiz results or acknowledgement logs for comprehension of the Acceptable Use Policy.
• Verify that specialised policies are reinforced through targeted technical training for IT staff.

10. Confirm Third-Party Policy Compliance

Audit how the organisation ensures that suppliers and contractors adhere to its security policies. Supply chain vulnerabilities often stem from third parties operating outside of the host organisation’s policy framework.

• Review Supplier Security Agreements for clauses mandating policy adherence.
• Verify that contractors are provided with a “Supplier-Specific” version of security policies.
• Check for evidence of third-party audits or self-attestations regarding policy compliance.

ISO 27001 Annex A 5.1 Audit Steps and Evidence

Audit Step	How To Execute	Common Examples of Evidence
1. Ownership Verification	Interview Policy Owners to confirm they understand their technical responsibilities.	Roles and Responsibilities Matrix, Asset Register entries.
2. Management Approval	Review Board or ISMS Committee minutes for policy sign-off dates.	Signed PDF policies, Meeting Minutes, Email approvals from the CEO.
3. Communication Audit	Sample employee records to find signed acknowledgements of the AUP.	HR Portal logs, Onboarding checklists, LMS completion certificates.
4. Review Cycle Check	Check the “Date of Last Review” against the “Review Frequency” defined in the ISMS.	Policy Revision History table, Calendar invites for review meetings.
5. Technical Alignment	Cross-reference the Password Policy with Active Directory or Okta settings.	Screenshots of MFA settings, Password complexity configurations.
6. Version Control	Attempt to access the policy folder as a guest to check for unauthorised edits.	SharePoint version history, restricted folder permissions.
7. Exception Logging	Inspect the register of active security exceptions for senior management signatures.	Risk Register, Signed Exception Request forms.
8. Training Integration	Review awareness training slides for policy-specific scenarios.	Training materials, Phishing simulation results based on policy.
9. Third-Party Alignment	Examine a random sample of supplier contracts for security annexes.	MSA (Master Service Agreements), Supplier Security Questionnaires.
10. Legal Mapping	Check if the Privacy Policy specifically references the Data Protection Act 2018.	Legal Register, Regulatory compliance cross-walk documents.

Top 3 mistakes and how to avoid them

In my experience, the top 3 mistakes people make for ISO 27001 Policies for Information Security are

1. You have no evidence that anything actually happened

You need to keep records and minutes of everything. You need a paper trail to show it was done. Make sure you have updated communication plans, minutes of meetings, records of acknowledgement, records of approval. If it isn’t written down it didn’t happen.

2. One or more members of your team haven’t done what they should have done

Prior to the audit check that all members of the team have done what they should have. Do they know where the policies are? Have they acknowledged them? Did someone join last month and forget to do it? Check!

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

Mapped to other Standards and Laws

Implementing ISO 27001 Annex A 5.1 ensures your organisation satisfies the foundational governance requirements of the entire global regulatory ecosystem. This exhaustive mapping table demonstrates how the policies provided in the ISO 27001 Toolkit meet the specific mandates of 2026’s most critical laws, from the UK’s new Data Act to US critical infrastructure mandates and global AI standards.

Standard or Law	Mapping Reference	Compliance Logic (The “How”)
GDPR / UK Data Protection Act	Articles 24 & 32	Mandates “appropriate technical and organisational measures.” Annex A 5.1 provides the mandatory governance layer and accountability evidence required for data protection.
UK Data (Use and Access) Act 2025	Section 1 & 4	Aligns security policies with refined UK data standards, ensuring reduced administrative burdens while maintaining the high security thresholds required for certification.
Cyber Security and Resilience Bill (UK)	Requirement A1	The UK’s legislative answer to NIS2, expanding mandatory reporting for MSPs. A 5.1 policies provide the internal reporting structures and leadership oversight mandated by the Bill.
NIST CSF 2.0	GV.PO-01, GV.PO-02	Under the “Governance” function, NIST requires security policies to be established, communicated, and enforced via formal management direction.
NIS2 Directive	Article 21(2)(a)	Specifically mandates “policies on risk analysis and information system security” for essential and important entities across the EU.
DORA (Financial Services)	Article 6	Requires a comprehensive “ICT risk management framework.” Annex A 5.1 provides the governance core of this multi-layered documentation for financial resilience.
SOC 2 (Trust Services Criteria)	CC1.1, CC5.1	Requires the “Control Environment” to define expectations. Policies establish the documented baseline for ethical conduct and security responsibilities.
EU AI Act	Articles 9 & 12	Mandates risk management and technical documentation for high-risk AI. Annex A 5.1 governs the creation of mandatory topic-specific AI ethics and model security rules.
ISO/IEC 42001 (AI Management)	Control 5.2	Requires a dedicated “AI Policy.” Annex A 5.1 ensures this AI policy is fully integrated into the wider organisational Information Security Management System (ISMS).
HIPAA (US Healthcare)	§ 164.308(a)(1)	Satisfies the administrative safeguard requirement for formal security management processes and assigned security responsibility.
California Data Laws (CCPA/CPRA)	Section 1798.100	Mandates “reasonable security procedures and practices.” Annex A 5.1 policies serve as primary evidence of an organisation’s “reasonable” approach to data protection.
CIRCIA (USA)	Reporting Mandates	A 5.1 policies ensure the organisation has the “Management Intent” and documented escalation paths to meet the mandatory 72-hour incident reporting window.
EU Product Liability Directive (PLD)	Defect Standard	Extends strict liability to software providers. Using Annex A 5.1 policies proves that providers followed an industry-recognised “Standard of Care” in their governance.
ECCF (European Framework)	Certification Schemes	Provides the foundational governance documentation required to apply for harmonised EU cybersecurity certification labels for digital products and services.

Applicability across different business models

Business Type	Applicability of Annex A 5.1	Key Policy Examples
Small Businesses	Focus on simplicity and consolidation. Policies should be approved by the business owner and communicated directly to staff. Avoid overly complex frameworks; merge topic-specific policies (e.g., Clear Desk, Remote Work) into a single Employee Handbook where possible to ensure 100% acknowledgement.	Acceptable Use Policy (AUP), Access Control Policy, Clear Desk & Screen Policy. Our guide to ISO 27001 for Annex A 5.1 for Small Business tackles the specific challenges Small Businesses face.
Tech Startups	Requires agile policy management that scales with rapid growth. Policies must cover digital-first operations and be integrated into onboarding flows (e.g., within HR tools). Frequent reviews are critical to address changing technology stacks and cloud environments.	Secure Development Policy, Cloud Security Policy, BYOD (Bring Your Own Device) Policy. Our guide to ISO 27001 for Annex A 5.1 for Tech Startups tackles the specific scaling and agile development challenges tech founders face.
AI Companies	High emphasis on data governance and ethical use. Policies must explicitly address the confidentiality and integrity of training data and models. Management direction must align with AI safety standards and evolving regulatory requirements for algorithmic transparency.	AI Data Governance Policy, Model Security Policy, Supplier Security Policy (Data Sources). Our guide to ISO 27001 for Annex A 5.1 for AI Companies tackles the data governance and training model security challenges AI teams face.

FAQ

Controls and Attribute Values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Confidentiality	Identify	Governance	Governance and Ecosystem
	Integrity			Resilience
	Availability

About the author