Information Security Management
Information Security Policy: What ISO 27001 Requires at the Top of the ISMS, With a Free Template
The information security policy is the document at the top of an ISMS. It is the one the standard requires by name (clause 5.2), the one top management signs, and the one the certification auditor reads first to decide what kind of system they are about to audit. It is also widely misunderstood: people expect a long document covering everything, when what the standard asks for is a short statement of intent with a set of topic-specific policies underneath it.
The complete toolkit, every policy, template and record you need. Free, no commitment
This guide covers what clause 5.2 and control 5.1 require, how the top-level policy relates to the policies beneath it, what to put in each part, a worked example, and the template from our toolkit.
Free information security policy template (Word)
The template is the top-level policy from our toolkit: the management commitment statement, scope, roles, the list of related policies, objectives, and the headline rules for training, physical security, third parties, access, credentials, cryptography and information classification, with a three-level classification scheme and handling guidance built in. Replace the placeholders and remove any section covered in more depth by one of your other policies.
It is one of 18 policy templates in the free ISO 27001 toolkit.
What the standard requires
Two places in ISO 27001:2022 cover this, and they ask for different things.
Clause 5.2, Policy (a mandatory requirement, not an Annex A control) says top management shall establish an information security policy that is appropriate to the purpose of the organisation, includes information security objectives or a framework for setting them, includes a commitment to satisfy applicable requirements, and includes a commitment to continual improvement of the ISMS. It must be available as documented information, communicated within the organisation, and available to interested parties as appropriate.
Control 5.1, Policies for information security (in Annex A) says that an information security policy and topic-specific policies shall be defined, approved by management, published, communicated to and acknowledged by relevant personnel and interested parties, and reviewed at planned intervals and when significant changes occur.
Put together: one short top-level policy that meets the four content requirements of clause 5.2, and a set of topic-specific policies (acceptable use, access control, and so on) that carry the detail, all approved, published, acknowledged and reviewed.
Top-level policy versus topic policies
The commonest structural mistake is to write one enormous information security policy that tries to do both jobs. It ends up forty pages long, nobody reads it, and every change to a detail means re-approving the whole thing.
The structure the standard describes, and the one our toolkit uses, is:
| Level | Document | Length | Who approves |
|---|---|---|---|
| Top | Information security policy | 2 to 6 pages | Managing director or board |
| Topic | Acceptable use, access control, password, data protection, data retention, cloud services, remote working, BYOD, mobile device, supplier security, secure development, patching, physical security, change management, asset management, malware, AI, incident response | 2 to 5 pages each | Information security manager, with management sign-off |
| Procedure | How specific tasks are done: user account management, backup and recovery, patching, incident reporting, and so on | As needed | Process owner |
The top-level policy names the topic policies and says that everyone must follow them. The topic policies carry the rules. The procedures carry the steps. Each layer can change without reopening the one above.
What goes in the top-level policy
- Purpose and management commitment. A statement that the business is committed to protecting the information it holds, setting and reviewing security objectives, meeting its legal, regulatory and contractual obligations, and continually improving the ISMS. Those last three are the clause 5.2 requirements, and the auditor will look for all three.
- Scope. What the policy applies to (all information, all formats) and whom (all staff, contractors, third parties). A pointer to the ISMS scope document for the boundaries.
- Objectives. Either the objectives themselves or where they are kept and how often they are reviewed.
- Roles and responsibilities. The steering group or equivalent, the information security manager, system and information owners, line managers, all staff. Brief; the detail goes in a roles document.
- Related policies. The list of topic policies, with a sentence saying everyone is required to know and follow them.
- Headline rules. A short section on each of the things everyone must know regardless of role: training, physical security, third parties, access, credentials, classification. These are summaries pointing to the topic policies, not replacements for them.
- Information classification. Many businesses put the classification scheme here because it is referenced by every other policy. Three levels (confidential, internal, public) with handling guidance for each is enough for most small businesses.
- Review and approval. Owner, version, approval, review date.
Worked example: the commitment statement
The opening section is the part top management actually has to own. Here is one for a fictional 30-person managed service provider.
Our commitment
Northgate IT Services provides managed IT and cloud services to professional services firms. Our clients trust us with access to their systems and their data, and that trust is the basis of our business.
Senior management is committed to protecting the confidentiality, integrity and availability of the information we hold and the information our clients entrust to us. To do that we will:
1. Set information security objectives each year, review them quarterly, and resource the work needed to meet them.
2. Meet the legal, regulatory and contractual requirements that apply to us, including UK GDPR and the security terms in our client contracts.
3. Operate an information security management system certified to ISO 27001, and continually improve it through audit, incident review and management review.
This policy and the topic policies beneath it apply to everyone who works for or with Northgate. They are communicated at induction and annually, and are available to clients and other interested parties on request.
Signed: [MD name], Managing Director, [date]
That is clause 5.2 met in under 200 words. The rest of the document is structure and signposting.
Communicating and acknowledging it
Control 5.1 adds “acknowledged by relevant personnel”. The auditor will want to see that staff have confirmed they have read the policy set, and that interested parties who need it (clients, often) can get it. In practice:
- Induction covers the top-level policy and the acceptable use policy, with a signed or electronic acknowledgement.
- Annual re-acknowledgement, usually as part of security awareness training.
- The policy classified Public (as the template is) so it can be sent to clients and prospects who ask, which they will.
- Material changes re-communicated and re-acknowledged.
Mistakes I see most at audit
- One giant policy. Everything in one document, so nothing is read and nothing can be changed without re-approving all of it.
- Missing a clause 5.2 element. Usually the commitment to continual improvement, or objectives with no framework for setting them.
- Not signed by top management. Approved by the IT manager. The clause says top management.
- Not communicated. Exists on a shared drive; staff interviewed have not seen it.
- Related policies listed that do not exist. The template lists fifteen policies; the business has written four. Delete the ones you do not have or write them.
- Never reviewed. Dated at implementation, untouched since.
Where to go next
The topic policies are where the work is. Start with the acceptable use policy, which every member of staff signs, then the ones your risk assessment points to: data retention, cloud security, patch management, clear desk, backup and, for software businesses, secure development. The ISO 27001 policies hub lists them all. For where clause 5.2 sits in the standard see the ISO 27001 clauses guide, and for help building the whole ISMS our ISO 27001 consultancy service starts with this document.
Frequently asked questions
What must an ISO 27001 information security policy contain?
Clause 5.2 requires it to be appropriate to the organisation’s purpose, to include security objectives or a framework for setting them, to commit to meeting applicable requirements, and to commit to continual improvement of the ISMS. It must be documented, communicated internally and available to interested parties. Control 5.1 adds that it and the topic-specific policies must be approved, published, acknowledged and reviewed.
How long should an information security policy be?
Two to six pages for the top-level policy. The detail belongs in topic-specific policies (acceptable use, access control, and so on) and procedures. A single forty-page policy is a common mistake that makes the document unread and hard to maintain.
Who approves the information security policy?
Top management, which in a small business means the managing director or the board. Clause 5.2 is explicit that top management establishes the policy, and auditors expect to see their signature or recorded approval rather than the IT manager’s.
What is the difference between the information security policy and topic-specific policies?
The information security policy is the short top-level statement of commitment, scope, roles and structure. Topic-specific policies carry the rules for one area each: acceptable use, access control, passwords, cloud, data retention and so on. Control 5.1 refers to both, and the top-level policy lists the topic policies beneath it.
Can I share the information security policy with customers?
Yes, and you should expect to be asked. Clause 5.2 requires it to be available to interested parties as appropriate. Classifying the top-level policy as Public, as our template does, means it can be sent to clients and prospects without redaction; the topic policies are usually Internal.
ISO 27001 Online Course + Full Toolkit
Stop guessing. Follow a proven step-by-step process.
“Highly recommended for anyone looking to understand ISO 27001, whether attempting it on your own or even using a consultant.“
Verified customer review
£285
Instant access
✓ Full toolkit included ✓ Learn as you build ✓ 12-month access ✓ 6 hours of video ✓ Call + email support
Author Background
This article was written by Alan Parker, an ISO 27001 consultant and founder of Iseo Blue Limited. He helps UK SMEs achieve certification in 90 days or less, often without a dedicated security team or a large budget.
With over 30 years in IT governance and information security, Alan works with software companies, IT service providers, managed service providers, and professional services firms across the UK, Europe, and internationally.
Qualifications: Certified ISO/IEC 27001:2022 Lead Auditor,
ITIL v3 Expert, ITIL v4 Bridge, PRINCE2 Practitioner. Named IT Project Expert of the Year (2024, UK). Alan writes in plain English for busy teams who need to get things done.
Connect on LinkedIn or Bluesky, or explore his free ISO 27001 tools and templates at iseoblue.com. B.Sc (Hons) Information Systems, CISMP certified.
