Introduction
I am going to show you what ISO 27001 Annex A 5.1 Policies for Information Security is, what’s new, give you ISO 27001 templates, an ISO 27001 toolkit, show you examples, do a walkthrough and show you how to implement it.
I am Stuart Barker the ISO 27001 Ninja and using over two decades of experience on hundreds of ISO 27001 audits and ISO 27001 certifications I show you exactly what changed in the ISO 27001 update and exactly what you need to do for ISO 27001 certification.
What is it?
ISO 27001 Annex A 5.1 Policies for Information Security is an ISO 27001 control that requires an organisation to have an information security policy and topic specific policies in place, communicated, reviewed and acknowledged.
I like this change from the old ISO 27001:2013 version as it calls out explicitly now that a pack or suite of policies will be required rather than just the headline information security policy.
Purpose
The purpose of the Annex A 5.1 Information Security Policies is to ensure the suitability, adequacy and effectiveness of managements direction and support for information security.
Definition
The ISO 27001 standard defines ISO 27001 Annex A 5.1 as:
Information security policy and topic-specific policies should be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur.
ISO 27001:2022 Annex A 5.1 Policies for Information Security
Implementation Guide
You are going to have to
- work out what policies you actually require
- write them
- sign them off
- publish them
- have them acknowledged by staff
- review them at regular intervals
The absolute best way to do this is download the prewritten ISO 27001 Policy Pack and follow the guide on How To Implement Policies.
ISO 27001 Policies Ultimate Reference Guide
In this ultimate guide to the ISO 27001 policies I show you what the requirement is for ISO 27001 and the detailed requirements for the new ISO 27001 standard of controls.
How to deploy and implement ISO 27001 Policies Video Tutorial
In this ISO 27001 Policy Implementation Guide I show you exactly how to deploy and implement the ISO 27001 Policies.
If you are resolutely dead set on going through the pain of this yourself you are going to need copies of the relevant standards for information security, about 1 to 2 months of your life dedicated to this and a lot, and I mean a lot, of patience.
Templates
ISO 27001 policy templates are a fast track that are guaranteed to save you time and money. ISO 27001 Annex A 5.1 Policy templates are focused on the ISO 27001 Policies and having and ISO 27001 Policy Pack. The benefit of using the ISO 27001 policy pack is that the ISO 27001 templates are already fully populated and ready to go.
How to comply
To comply with ISO 27001 Annex A 5.1 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to
- Write an information security policy
- Supplement that information security policy with topic specific policies
- Ensure your policies are classified and have document mark up
- Have the policies approved by management and have evidence of that happening
- Publish the policies to a place everyone that needs to see them can see them
- Tell those people where those policies are
- Communicate your policies as part of your communication plan and document you did it
- Get people to acknowledge the policies and keep evidence that they have
- Plan to review your policies at least annually or if significant change occurs
- Keep records of your policy review and the changes
How to pass an audit
To pass an audit of ISO 27001 Annex A 5.1 you are going to make sure that you have followed the steps above in how to comply.
You are going to do that by first conducting an internal audit, following the How to Conduct an ISO 27001 Internal Audit Guide.
What will the audit check?
The audit is going to check a number of areas for compliance with Annex A 5.1. Lets go through them
1. That you can link policy to requirements
What this means is that you need to show that your policies are linked
- to the business strategy (which you recorded and evidenced in your organisation overview document).
- to the law, regulations and contracts (which you recorded in the legal register).
- to risks (which you recorded in your risk register ).
2. That your policy includes required statements
For the main information security policy there are some required statements that need to be included. You need to
- define information security and the confidentiality, integrity and availability definition
- include your information security objectives
- include principles that will guide on information security activities activities
- include a commitment to satisfy applicable requirements related to information security
- have a commitment to continually improving your information security management system
- assign responsibilities for information security management to defined roles
- cover how you handle exemptions and exceptions.
3. That top management approved the policy
The audit will look to see that the main information security policy and the topic specific policies have been approved and signed off by top management. The level will have been defined in your ISO 27001 Roles and Responsibilities Template document in line with ISO 27001 Annex A 5.2 Roles and Responsibilities
How do you monitor the effectiveness of Annex A 5.1?
The approaches to monitoring the effectives of Annex A 5.1 include:
- Internal audit of the policies
- External audit of the policies
- Review of system logs and alerts for anomalies in operation
Top 3 Mistakes People Make
In my experience, the top 3 mistakes people make for ISO 27001 Annex A 5.1 are
1. You have no evidence that anything actually happened
You need to keep records and minutes of everything. You need a paper trail to show it was done. Make sure you have updated communication plans, minutes of meetings, records of acknowledgement, records of approval. If it isn’t written down it didn’t happen.
2. One or more members of your team haven’t done what they should have done
Prior to the audit check that all members of the team have done what they should have. Do they know where the policies are? Have they acknowledged them? Did someone join last month and forget to do it? Check!
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
FAQ
The list of policies you need can be found here in the High Table Ultimate Guide to ISO 27001 Policies.
You decide what policies you need by first completing your Statement of Applicability and then identify in conjunction with the ISO 27001 standard the required policies for your implementation.
The list of policies you need can be found here in the High Table Ultimate Guide to ISO 27001 Policies.
There are templates for ISO 27001 Annex A 5.1 located in the High Table ISO 27001 Policy Templates Toolkit.
All of the ISO 27001 Policies have free, example PDF’s that you can download in the the High Table ISO 27001 Policy Templates Toolkit.
Yes. Whilst the ISO 27001 Annex A clauses are for consideration to be included in your Statement of Applicability there is no reason we can think of that would allow you to exclude ISO 27001 Annex A 5.1. Policies are a fundamental part of any governance, risk and compliance framework. They are a fundamental part of any information security management system. They are explicitly required for ISO 27001.
Yes. You can write the policies for ISO 27001 Annex A 5.1 yourself. You will need a copy of the standard and approximately 3 months of time to do it. It would be advantageous to have a background in information security management systems. Alternatively you can download the ISO 27001 Policy Toolkit.
ISO 27001 templates for ISO 27001 Annex A 5.1 are located in the High Table ISO 27001 Policy Templates Toolkit.
ISO 27001 Annex A 5.1 is not particularly hard. It can take a lot of time if you are doing it yourself but it is not technically very hard. Policies are statements of what you do so as long as you know what you do, or will do, you are in a good place. We would recommend templates to fast track your implementation.
ISO 27001 Annex A 5.1 will take approximately 3 months to complete if you are starting from nothing and doing it yourself. With an ISO 27001 Policy Template bundle it should take you less than 1 day.
The cost of ISO 27001 Annex A 5.1 will depend how you go about it. If you do it yourself it will be free but will take you about 3 months so the cost is lost opportunity cost as you tie up resource doing something that can easily be downloaded. If you download an ISO Policy Template toolkit then you are looking at a couple of hundred pounds / dollars.
ISO 27001 Annex A 5.1 Information Security Policies is important because people need to know what is expected of them. Policies are statements of what you do. They are not statements of how you do it. How you do it is covered in process documents.
The policies tell people what is expected of them and what they should do.
From a HR perspective you have no come back if someone does something wrong unless you have told them what they should do right and the consequences for getting it wrong.
If you don’t tell me, I don’t know.
No matter how simple, straightforward, obvious or common sense YOU think it is, someone, somewhere will disagree and there is nothing you can do about it unless you have told them.
The senior leadership team is responsible for the information security policies. As the policies set out the direction and what must be done it is the responsibility of the senior leadership to set and agree that direction.
Other than your ISO 27001 certification requiring it, the following are benefits of implementing ISO 27001 Annex A 5.1:
Improved security: People will know what is expected of them reducing the likelihood and impact of an attack
Reduced risk: Having direction on how you do things will reduce risk
Improved compliance: Standards and regulations require information security policies to be in place
Reputation Protection: In the event of a breach having effective policies will reduce the potential for fines and reduce the PR impact of an event
Yes, there is an online ISO 27001 at ISO 27001 Online.
Get the Help of the ISO 27001 Ninja
Book your FREE 30 Minute ISO 27001 Strategy Call and let me show you how you can do it 30x cheaper and 10x faster that you ever thought possible.
Controls and Attribute Values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Confidentiality | Identify | Governance | Governance and Ecosystem |
| Integrity | Resilience | |||
| Availability |