Policies for information security

What the control asks

An overarching information security policy and a set of topic-specific policies are to be written, signed off by management, made available, brought to the attention of the staff and outside parties they concern, confirmed as received by those people, and revisited on a schedule and whenever something significant changes. Purpose: keep management's direction on information security fit, sufficient and working, in line with business, legal, regulatory and contractual needs. Guidance: top management approves the top-level policy, which states how the organization runs information security and draws on business strategy, laws and contracts, and present and expected risks and threats. It should cover what information security means for the organization, its objectives or how they are set, guiding principles, a commitment to meet applicable requirements and to keep improving the ISMS, which roles hold which responsibilities, and how exemptions and exceptions are handled; top management signs off any change to it. Beneath it sit topic-specific policies aimed at particular audiences or areas (for example access control, physical security, assets, information transfer, endpoint configuration, networks, incident management, backup, cryptography and keys, classification, technical vulnerabilities and secure development), consistent with the top policy and owned by people with the right authority and expertise. Reviews look for improvement and respond to shifts in strategy, technology, law and contracts, risks, the threat landscape and incident lessons, using management review and audit results, and check related policies for consistency. Policies should be understandable to their readers, acknowledged where appropriate, and screened for confidential content before being shared externally. The top policy is general and approved by top management; topic policies are detailed and approved at a suitable management level.

Purpose in the standard’s terms, in our words: Keeps the direction and backing management gives to information security suitable, adequate and effective against business, legal, regulatory and contractual needs.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Identify; Governance; Governance and ecosystem, Resilience.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• The top-level information security policy with top management approval, covering the definition, objectives or objective-setting framework, principles, commitments to requirements and continual improvement, role assignments and the exceptions procedure
• The register of topic-specific policies with an owner, approving manager and version for each
• Review records showing the planned interval met and ad hoc reviews after changes in strategy, technology, regulation, risk, threats or incidents, with management review and audit results as inputs
• Acknowledgement records from personnel and relevant external parties that they understand and will comply
• Change log showing top management approval of every change to the top-level policy
• Evidence that externally distributed policy versions were checked for confidential content

Where audits commonly find gaps

• Topic-specific policies referenced in the top policy were never written or have no named owner
• Reviews are calendar driven only and ignore significant incidents or regulatory change
• No procedure exists for handling exemptions and exceptions, so exceptions are granted informally
• Acknowledgement collected once at onboarding and never again after policy revisions

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (05.1.1, 05.1.2) is kept in the register so an older audit file can still be traced. It serves more than one security domain, which is why a domain count taken by row understates the view.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.2 Information security roles and responsibilities
• 5.4 Management responsibilities
• 5.5 Contact with authorities

Read the five attributes All 93 controls