How do we write an information security policy and objectives that stand up to an ISO 27001 audit?

Start

We need an information security policy and objectives for ISO 27001

The policy and the objectives are among the eight items without which the pack says a Stage 2 audit cannot pass. Top management establishes them, and they come early in the plan: the policy direction is approved at the first gate, and the objectives are set when the controls are chosen.

• Then: Does a top-level information security policy already exist?

Decision

Does a top-level information security policy already exist?

Many organisations already have one. Reuse it if it can be made to fit rather than starting again. If you are not sure it is current or approved, answer no.

• Yes: Check the existing policy against what auditors find missing
• No, or not known: Write a short top-level policy

Step

Write a short top-level policy

A short policy signed by top management, with topic-specific policies beneath it. Keep it to direction and commitments: what the organisation intends and why, leaving rules and steps to the documents below. Use the policy template to keep the form consistent.

• Then: Does it fit your purpose, carry the commitments and set objectives?

Step

Check the existing policy against what auditors find missing

The pack lists the usual gaps: no objectives or framework for setting them, no commitment to continual improvement, signed by someone other than top management, not available to the people it applies to, and a review date that has passed.

• Then: Does it fit your purpose, carry the commitments and set objectives?

Decision

Does it fit your purpose, carry the commitments and set objectives?

Public guides to the standard describe four contents: fit with the organisation's purpose, a commitment to meet the requirements that apply, a commitment to continual improvement, and either objectives or a framework for setting them. If any is missing or unclear, answer no.

• Yes: Is it approved and signed by top management, not by the security team?
• No, or not known: Add the missing commitments and the objectives framework

Step

Add the missing commitments and the objectives framework

Say in plain sentences what the organisation commits to, and say how objectives are set and who sets them. A combined policy with an information security section is accepted if it carries these commitments and is communicated.

• Then: Is it approved and signed by top management, not by the security team?

Decision

Is it approved and signed by top management, not by the security team?

A policy signed by someone other than top management is one of the gaps the pack lists. Top management here means the board or a committee it has delegated to, the management board in a two-tier structure, or executive management where there is no board. If unsure, answer no.

• Yes: Communicate it and make it easy to reach
• No, or not known: Take it to top management for approval and record the date

Step

Take it to top management for approval and record the date

Present the policy as a decision, not a circulation. Record who approved it and when, give it a version and a review date, and keep the approval under document control.

• Then: Communicate it and make it easy to reach

Step

Communicate it and make it easy to reach

Publish it in one place staff can reach, get it acknowledged, and review it at least every 12 months or after a significant change. Auditors may ask staff where it is. Public guides also expect it to be available to interested parties where that is appropriate.

• Then: Is the Statement of Applicability approved?

Decision

Is the Statement of Applicability approved?

Only the controls you choose need documents. Writing a full policy set first produces documents nobody runs, which the auditor then samples. If the Statement is not yet approved, answer no.

• Yes: Write only the topic policies your chosen controls need
• No, or not known: Hold the topic policies until the controls are chosen

Step

Hold the topic policies until the controls are chosen

Keep the top-level policy now and write the topic policies after the controls are chosen. Do not buy a toolkit of dozens of policies describing processes nobody runs. Come back and write the topic policies once the Statement is approved.

• Then: Set five to ten objectives

Step

Write only the topic policies your chosen controls need

Use the policy profile to decide which topics your size, regulators and certification target call for, and write the rest only if a control needs them. Each must be short, testable and owned.

• Then: Set five to ten objectives

Step

Set five to ten objectives

Each objective has a measure, a target, an owner, the resources, a date and how the result is evaluated. Take them from your risk results where you have them, and from the requirements that apply, and keep them consistent with the policy. Top management sets them.

• Then: Can each objective be measured by something you can collect?

Decision

Can each objective be measured by something you can collect?

The pack and auditors expect objectives that can be measured or tested; an unmeasured one is a common finding. If no figure or yes or no test can show whether it was met, or you are not sure the data exists, answer no.

• Yes: Start measuring when the controls run, and report upward
• No, or not known: Reword it until a figure or a clear test can show it

Step

Reword it until a figure or a clear test can show it

Change the objective, or the measure, so the data exists. Drop the objective if no honest measure can be found.

• Then: Start measuring when the controls run, and report upward

Step

Start measuring when the controls run, and report upward

Begin measuring in the implementation phase. Keep dated results, analyse them, and take the trend to top management at the management review, since the certification body expects to see the objectives monitored.

• Then: Do the people who deliver each objective know it?

Decision

Do the people who deliver each objective know it?

Objectives must be communicated to the people who deliver them. If you have not told them, or cannot show that you did, answer no.

• Yes: Review the policy and objectives at the planned interval
• No, or not known: Tell the owners and the teams, and keep a record

Step

Tell the owners and the teams, and keep a record

Send the objectives to their owners and delivery teams in a short note or briefing, and keep it. Repeat when an objective changes.

• Then: Review the policy and objectives at the planned interval

Step

Review the policy and objectives at the planned interval

Review at least every 12 months, after a significant change, and when the management review calls for it. Update the version and keep the record of the review.

• Then: Are topic policies still waiting for the Statement of Applicability?

Decision

Are topic policies still waiting for the Statement of Applicability?

If the Statement was not approved when you reached the topic policies, they are still to write. Write only the ones the chosen controls need. If you are not sure, answer yes.

• Yes, or not known: Write the topic policies the chosen controls need
• No: Policy approved, objectives set and measured: keep the records

Step

Write the topic policies the chosen controls need

Once the Statement of Applicability is approved, write and approve only the topic policies its controls call for, in the same short testable form.

• Then: Policy approved, objectives set and measured: keep the records

Outcome

Policy approved, objectives set and measured: keep the records

Keep the approved policy, the acknowledgement records, the objectives and their measurement results as controlled records. Certification bodies read the policy and objectives at Stage 1 and sample the records at Stage 2.