ISO 27001 Information Security Policy Beginner’s Guide

ISO 27001 Information Security Policy

The ISO 27001 Information Security Policy is the headline policy for information security. It sets out the organisations approach to information security management and covers the confidentiality, integrity and availability of data.

In the ISO 27001:2022 update the standard changed to include the concept of topic specific policies. These topic specific policies, based on organisational need sit under the main information security policy.

ISO 27001 Information Security Policy Template

The ISO 27001 Information Security Policy Template is pre written and ready to go. It is an ISO 27001 mandatory document and one of the required ISO 27001 Policies.

DO IT YOURSELF ISO 27001

All the templates, tools, support and knowledge you need to do it yourself.

The Ultimate ISO 27001 Toolkit

ISO 27001 Information Security Policy Example

This is an example ISO 27001 Information Security Policy:

Why is the ISO 27001 Information Security Policy Important?

An information security policy is important because your organisation processes, stores and transmits valuable data and information that needs to be protected.

To understand the value of an information security policy, let’s break out the data we are protecting into three parts.

Customer Data: what ever your product or service, you are going to be handling customer data of some description. It could be customer personal information, order information, technical information. What is fundamental is that your customer cares deeply about that information. They also care about how you are taking care and protecting it. 

Employee Data: you have employees and you have their most private and personal information. It is likely that you have names, address, bank details, social security and tax information, sickness information, performance data, pension information and more. Your employees care deeply about the protection of their most private information. 

Company Data: you have financial data relating to your performance, you have customer databases and CRM, you potentially have intellectual property or secrets about the way you conduct business. Your owners care a lot about protecting this to protect their profits.

The ISO 27001 Information Security Policy is important as it sets out clearly the approach to information security management and what you expect to happen.

How to write an ISO 27001 Information Security Policy

The ISO 27001 standard was updated in 2022 and this guide shows you how to write an Information Security Policy to meet the requirements of the updated standard.

The ISO 27001 Information Security Policy is required to be presented in a certain way. What we mean by that is that the policy is expected to have certain document markup. Document mark up is just a fancy words for having certain information on the policy. It will need version control, a version number, an owner, an information security classification. An exampleISO 27001 Information Security Policy table of contents would look something like this:

• Document Version Control
• Document Contents Page
• Purpose
• Scope
• Information Security Policy
• Principle
• Chief Executives Statement of Commitment
• Introduction
• Information Security Defined
• Information Security Objectives
• Information Security Policy Framework
• Information Security Roles and Responsibilities
• Monitoring
• Legal and Regulatory Obligations
• Policy Compliance
• Compliance Measurement
• Exceptions
• Non-Compliance
• Continual Improvement

Create your version control and document mark-up

ISO 27001 documents require version control of the author, the change, the date and the version as well as document mark up such as document classification.

Write the information security policy purpose

The purpose of the information security policy is to protect against loss of data.

Write the scope of the information security policy

Consider the scope of the information security policy. It should really apply to all employees and third party staff working for your company.

Write the principle on which the information security policy is based

The principle of the policy is the confidentiality, integrity and availability of data. It is about the security and protection of of confidential data.

Write a chief executives statement of commitment

Write a statement from the most senior person in the organisation about the organisations commitment to information security. Provide a date for the quote.

An examples chief executives statement of commitment:

“As a company, information processing is fundamental to our success and the protection, availability, and security of that information is a board level priority. Whether it is employee information or customer information we take our obligations under the law seriously. We have provided the resources to develop, implement and continually improve the information security management and business continuity management system appropriate to our business.”

[Chief Executive Officer Name and Date and Signature]

Define information security

Provided a definition for information security and for the terms confidentiality, integrity and availability.

An example would be:

Confidentiality: Access to information is to those with appropriate authority

Integrity: Information is complete and accurate

Availability: Information is available when it is needed

Describe the policy framework

Provide a description of the policy framework and list out the policies that are part of it.

Set out the roles and responsibilities

Create a definition of each of the roles for information security and what their responsibilities are.

Describe how you will monitor the effectiveness of information security

Layout the measures and monitors that you will use to verify that the information security is effective.

Document your legal and regulatory obligations

Working with legal counsel set out the laws and regulations that your organisation follows

Define policy compliance

Provide for how compliance to the policy will be achieved.

How to implement an information security policy

To implement an information security policy into your organisation you are going to:

• Write your information security policy following the steps above.
• Approve and sign off the information security policy
• Communicate the information security policy to relevant people
• Have them accept the policy
• Review the policy on an annual basis.

ISO 27001 Information Security Policy Framework

The information security management system is built upon an ISO 27001 Policies. These are mandatory ISO 27001 documents. In conjunction with the information security policy, the following policies make up the policy framework:

• Data Protection Policy
• Data Retention Policy
• ISO 27001 Information Security Policy ( this policy )
• ISO 27001 Access Control Policy
• ISO 27001 Asset Management Policy
• ISO 27001 Risk Management Policy
• ISO 27001 Information Classification and Handling Policy
• ISO 27001 Information Security Awareness and Training Policy
• ISO 27001 Acceptable Use Policy
• ISO 27001 Clear Desk and Clear Screen Policy
• ISO 27001 Mobile and Teleworking Policy
• ISO 27001 Business Continuity Policy
• ISO 27001 Backup Policy
• ISO 27001 Malware and Antivirus Policy
• ISO 27001 Change Management Policy
• ISO 27001 Third Party Supplier Security Policy
• ISO 27001 Continual Improvement Policy
• ISO 27001 Logging and Monitoring Policy
• ISO 27001 Network Security Management Policy
• ISO 27001 Information Transfer Policy
• ISO 27001 Secure Development Policy
• ISO 27001 Physical and Environmental Security Policy
• ISO 27001 Cryptographic Key Management Policy
• ISO 27001 Cryptographic Control and Encryption Policy
• ISO 27001 Document and Record Policy

ISO 27001 Information Security Policy FAQ