Control 5.2Policy

Top management must establish an information security policy that is appropriate to the organisation’s purpose, includes information security objectives or provides the framework for setting them, includes a commitment to satisfy applicable requirements and to continual improvement of the ISMS, is available as documented information, is communicated within the organisation, and is available to interested parties as appropriate.

The policy is a short document doing a specific job: stating the organisation’s intent at a level that the objectives in 6.2 and the topic-specific policies under A.5.1 can be derived from.

Two failures recur. The first is a policy so generic it could belong to any organisation, which then provides no framework for anything. The second is length — a forty-page document combining policy, standards and procedures, which cannot be communicated meaningfully and which nobody outside the security function has read. The clause asks for it to be communicated, and an auditor will test that by asking somebody.

How to put this in place

The policy states the organisation's direction for security and gives the system its authority. A policy signed by the wrong person, or not read, is a repeated finding.

Draft a short top-level policy that sets direction, objectives framework and commitment to improve.
Align it with the scope and the risks.
Have top management approve and sign it.
Publish it where staff, and relevant outside parties, can find it, and obtain acknowledgements.
Set a review date and review it at least yearly.

Evidence an auditor usually looks for: the approved policy signed by top management, evidence of communication and acknowledgement, and a review date that has not passed.

What is in the packs for this

From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.

ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 3 (Select and document controls) of the implementation plan, which sets out the work and the gate that closes the phase.
Mandatory ISMS Documentation ChecklistExcel
Required Documents sheet, item MD-02: the typical form, what auditors accept instead and the gaps they reliably find.
Certification Readiness Self-AssessmentExcel
A blocking item in the readiness assessment, which treats it as needing to be operating before a Stage 2 audit.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.