Information security policy under ISO 27001
The information security policy is a mandatory document under ISO 27001 . The NEN version of the standard requires it in clause 5.2. The policy sets out the intentions and direction of the organisation for information security. It does not cover technical details, which belong in procedures. It covers the vision, the principles and the commitment of top management.
A good policy fits on one or two pages. It is not a checklist for the auditor, but a text that employees understand and that genuinely describes the direction. The policy sits at the top of your mandatory documentation.
What does clause 5.2 require?
Clause 5.2 of ISO 27001 requires top management to establish an information security policy that:
| Requirement | What it means |
|---|---|
| Is suitable for the organisation and its context | The policy fits your sector, size and risk profile. It is not a generic template |
| Provides a framework for objectives | From the policy, you derive measurable security objectives |
| Includes a commitment to meet requirements | Stated explicitly: the organisation complies with relevant laws and regulations |
| Includes a commitment to continual improvement | A PDCA attitude is explicitly recorded |
| Is available as documented information | Version, date and approval are recorded |
| Is communicated to employees | Everyone knows the policy exists and where to find it |
| Is available to interested parties | Clients or supervisory bodies can request it |
Top management must establish the policy, not the IT department. ISO 27001 places responsibility for information security explicitly with management. The signature of the CEO or managing director is not a formality. It is a normative requirement.
Structure of an information security policy
There is no mandatory format. Below is a structure that most auditors recognise and that covers all the requirements of the standard.
| Section | Content |
|---|---|
| Purpose and scope | What does this policy apply to? (link it to the ISMS scope) |
| Vision and commitment | Why does the organisation consider information security important? |
| Principles | Five to seven basic rules that set the direction |
| Objectives | Two to four measurable goals for the current year |
| Roles and responsibilities | Who owns the ISMS? Who is responsible for implementation? |
| Compliance and consequences | What are the consequences of not complying? |
| References | Reference to related procedures and the standard |
| Control | Version, date, author, approved by |
A concrete example of a principle
Abstract policy statements say nothing. Make sure every principle is recognisable to employees.
❌ Vague: “The organisation takes appropriate technical and organisational measures to protect information.”
✅ Concrete: “Employees use a password manager and multi-factor authentication for all systems that give access to client data. Passwords are never shared by email.”
The difference: the concrete example tells an employee directly what to do. The vague version is legal wording that could even serve as cover in a security incident.
Policy versus procedures: the difference
A common mistake is combining the policy and procedures in one document. They serve different purposes.
| Document | Answers | Updated |
|---|---|---|
| Policy | What do we want to achieve, and why? | Annually, or after major changes |
| Procedure | How do we carry that out? | More often, when processes change |
| Work instruction | What are the exact steps? | With every system change |
The policy sits at the top of the document hierarchy. A procedure for access management describes how you create and revoke accounts. The policy says: “Access is granted on the basis of the need-to-know principle.” The procedure describes the process; the policy describes the direction.
Maintaining the policy
ISO 27001 requires the policy to be reviewed at planned intervals. The policy is also the basis for your information security objectives. The auditor checks whether the policy is current and whether the version date matches the reality of the organisation.
Plan an annual review as part of the management review. Ask these questions:
- Does the policy still reflect the current risks and context?
- Are the objectives still realistic and relevant?
- Have there been legal or contractual changes that affect the policy?
- Are roles and responsibilities still correct?
Record the outcome of the review in the minutes of the management review. If the policy changes, update the version, have it approved again, and communicate the changes to employees.
A policy from 2022 that has not changed while your organisation has grown, merged or moved to the cloud is a red flag for the auditor. Make sure the policy reflects current reality.
More information
- Requirements of the standard: clause 5.2 explained
- The ISMS: the management system that the policy is part of
- Mandatory documents: a full overview of what the standard requires
- Step-by-step plan: when do you write the policy in the process?
- ISO/IEC 27001:2022 : official text of the standard (ISO.org)
- NEN-EN-ISO/IEC 27001 : Dutch version (NEN)