ISO 27001 Information Security Policy Beginner’s Guide

Time needed: 1 hour and 30 minutes

How to write an information security policy

1. Create your version control and document mark-up

   ISO 27001 documents require version control of the author, the change, the date and the version as well as document mark up such as document classification.

2. Write the ISO 27001 Information Security Policy purpose

   Write the purpose of the document. The purpose of this policy is to set out the information security policies that apply to the organisation to protect the confidentiality, integrity, and availability of data.

3. Write the ISO 27001 Information Security Policy scope

   Consider the scope of the information security policy. The scope of the policy is all employees and third party staff working for your company.

4. Write the ISO 27001 Information Security Policy principle

   The principle of the policy is information security is managed based on risk, legal and regulatory requirements, and business need.

5. Write a chief executives statement of commitment

   Write a statement from the most senior person in the organisation about the organisations commitment to information security. Provide a date for the quote. An example:
   
   “As a company, information processing is fundamental to our success and the protection, availability, and security of that information is a board level priority. Whether it is employee information or customer information we take our obligations under the law seriously. We have provided the resources to develop, implement and continually improve the information security management and business continuity management system appropriate to our business.” [Chief Executive Officer Name and Date and Signature]

6. Write an introduction to the policy

   Set out what the policy covers and why you have it. An example:
   
   Information security protects the information that is entrusted to us. Getting information security wrong can have significant adverse impacts on our employees, our customers, our reputation, and our finances. By having an effecting information security management system, we can:
   
   – Provide assurances for our legal, regulatory, and contractual obligations
   – Ensure the right people, have the right access to the right data at the right time
   – Provide protection of personal data as defined by the GDPR
   – Be good data citizens and custodians

7. Write your information security objectives

   Set the objectives for the information security management system. An example:
   
   To ensure the confidentiality, integrity and availability of organisation information including all personal data as defined by the GDPR based on good risk management, legal regulatory and contractual obligations, and business need.
   
   To provide the resources required to develop, implement, and continually improve the information security management system.
   
   To effectively manage third party suppliers who process, store, or transmit information to reduce and manage information security risks.
   
   To implement a culture of information security and data protection through effective training and awareness.

8. Define information security

   Provided a definition for information security and for the terms confidentiality, integrity and availbabilty.

9. Describe the policy framework

   Provide a description of the policy framework and the policies that are part of it. An example:
   
   The information security management system is built upon an information security policy framework. In conjunction with this policy, the following policies make up the policy framework:
   
   DP 01 Data protection Policy
   DP 02 Data Retention Policy
   IS 01 Information Security Policy (this policy)
   IS 02 Access Control Policy
   IS 03 Asset Management Policy
   IS 04 Risk Management Policy
   IS 05 Information Classification and Handling Policy
   IS 06 Information Security Awareness and Training Policy
   IS 07 Acceptable Use Policy
   IS 08 Clear Desk and Clear Screen Policy
   IS 09 Mobile and Teleworking Policy
   IS 10 Business Continuity Policy
   IS 11 Backup Policy
   IS 12 Malware and Antivirus Policy
   IS 13 Change Management Policy
   IS 14 Third Party Supplier Security Policy
   IS 15 Continual Improvement Policy
   IS 16 Logging and Monitoring Policy

10. Set out the roles and responsibilities

    Create a definition of each of the roles for information security and what their responsibilities are. An example:
    
    Information security is the responsibility of everyone to understanding and adhere to the policies, follow process and report suspected or actual breaches. Specific roles and responsibilities for the running of the information security management system are defined and recorded in the document Information Security Roles Assigned and Responsibilities

11. Describe how you will monitor the effectiveness of information security

    Layout the measures and monitors that you will use to verify that the information security is effective. An example:
    
    Compliance with the policies and procedures of the information security management system are monitored via the Management Review Team, together with independent reviews by both Internal and External Audit on a periodic basis.

12. Document your legal and regulatory obligations

    Working with legal counsel set out the laws and regulations that your organisation follows. An example:
    
    The organisation takes its legal and regulatory obligations seriously and these requirements are recorded in the document Legal and Contractual Requirements Register

13. Set out your approach to training and awareness

    Define how you do training and awareness. An example:
    
    Policies are made readily and easily available to all employees and third-party users. A training and communication plan is in place to communicate the policies, process, and concepts of information security. Training needs are identified, and relevant training requirements are captured in the document Competency Matrix.
    

14. Describe you approach to continual improvement

    Describe how you go about doing continual improvement. An example:
    
    The information security management system is continually improved. The continual improvement policy sets out the company approach to continual improvement and there is continual improvement process in place.

15. Define policy compliance

    Provide for how compliance to the policy will be acheived.