Information Security Management
ISO 27001 Policies: Which Ones You Need, What Each Must Say, and Free Templates
ISO 27001 requires one top-level information security policy (clause 5.2) and a set of topic-specific policies beneath it (control 5.1). It does not say which topics; your risk assessment and Statement of Applicability do. The guides below cover the policies most small businesses need, what each one must say, how auditors test it, and the template from our toolkit to start from.
The complete toolkit, every policy, template and record you need. Free, no commitment
The policy set
| Policy | What it covers | ISO 27001 controls |
|---|---|---|
| Information security policy | The top-level statement of commitment, scope, roles and the policies beneath it | Clause 5.2, control 5.1 |
| Acceptable use policy | What staff may and may not do with company systems, data and devices | 5.10 |
| Clear desk and clear screen policy | Papers, media and screens not left exposed, in the office or anywhere else | 7.7 |
| Data retention policy | How long each type of information is kept and how it is deleted | 5.33, 8.10, 5.31, 5.34 |
| Cloud security policy | Approving, using, managing and leaving cloud services | 5.23 |
| Patch management policy | Finding and fixing technical vulnerabilities within set timescales | 8.8 |
| Backup policy | What is backed up, how often, where, and how restores are tested | 8.13 |
| Secure development policy | How software is built securely, for teams that develop | 8.25 to 8.32 |
More guides will be added as they are written. The free ISO 27001 toolkit has all 18 policy templates now, including access control, password, data protection, BYOD, mobile device, remote working, supplier security, asset management, change management, physical security, malware and AI policies.
How many policies do you need?
Fewer than most templates suggest. The standard requires the top-level policy and whatever topic-specific policies your risks justify. A ten-person consultancy can run a certified ISMS on six or seven short policies; a software company with its own cloud platform needs a few more. What matters is that each policy is approved, communicated, acknowledged by the people it applies to, and reviewed. Eighteen policies nobody has read are worse than six that everyone has.
How the policies relate to the controls
Each policy is the written rule for one or more Annex A controls, and the Statement of Applicability is where you record which. The controls list and the Annex A guide cover all 93 controls; the policy guides above cover the ones that most often need a document of their own.
Where to go next
If you are starting from nothing, write the information security policy first, then the acceptable use policy, then the rest in the order your risk assessment points to. For help getting the full set written and approved, our ISO 27001 consultancy service does it with you.
ISO 27001 Online Course + Full Toolkit
Stop guessing. Follow a proven step-by-step process.
“Highly recommended for anyone looking to understand ISO 27001, whether attempting it on your own or even using a consultant.“
Verified customer review
£285
Instant access
✓ Full toolkit included ✓ Learn as you build ✓ 12-month access ✓ 6 hours of video ✓ Call + email support
Author Background
This article was written by Alan Parker, an ISO 27001 consultant and founder of Iseo Blue Limited. He helps UK SMEs achieve certification in 90 days or less, often without a dedicated security team or a large budget.
With over 30 years in IT governance and information security, Alan works with software companies, IT service providers, managed service providers, and professional services firms across the UK, Europe, and internationally.
Qualifications: Certified ISO/IEC 27001:2022 Lead Auditor,
ITIL v3 Expert, ITIL v4 Bridge, PRINCE2 Practitioner. Named IT Project Expert of the Year (2024, UK). Alan writes in plain English for busy teams who need to get things done.
Connect on LinkedIn or Bluesky, or explore his free ISO 27001 tools and templates at iseoblue.com. B.Sc (Hons) Information Systems, CISMP certified.
