Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Control A.5.1Policies for information security

What it means in practice

The organisation’s information security policy and its topic-specific policies must be defined, approved by management, published, communicated to and acknowledged by the people they apply to, and reviewed at planned intervals and when significant changes occur.

Two layers, and conflating them is the most common mistake. The information security policy is the single high-level statement clause 5.2 requires of top management. Topic-specific policies sit beneath it — access control, cryptography, acceptable use, secure development, supplier security — and are approved at the level appropriate to their subject.

The requirement that is hardest to evidence is acknowledgement by the relevant personnel. A policy published on an intranet has been made available; that is not the same thing, and an auditor asking a member of staff which policies apply to their work is testing exactly this.

Review “when significant changes occur” is the part that decays first. A policy set reviewed annually by calendar and never by event will describe an organisation that has moved on.

How to put this in place

An ISMS project needs one approved policy that sets direction, because every later rule, risk decision and audit question points back to it. Without it, teams make up their own rules and nobody can show what management actually asked for.

  1. Decide which topics your risks need a policy for, and keep the list short.
  2. Draft a top-level policy and the topic policies in plain words, each with an owner.
  3. Get top management to approve the top-level policy and record the approval.
  4. Publish the set in one place and collect acknowledgements from staff and contractors.
  5. Set a review date for each policy and record every review, even when nothing changes.

Evidence an auditor usually looks for: the approved policy set with versions and approval dates, acknowledgement records for a sample of staff, and the record of the last review.

What is in the packs for this

Each one helps with this requirement.

  • Excel

    Annex A Control Implementation Library

    in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
  • Excel

    Statement of Applicability Template

    in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
  • Excel

    Mandatory ISMS Documentation Checklist

    in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists the information security policy and the topic-specific policies among the documents auditors commonly expect for this control.
  • Word

    Stage 1 and Stage 2 Audit Preparation Guide

    in ISO 27001 Implementation & Certification ReadinessListed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.
  • Word

    Security Exception & Waiver Standard

    in Security Exception, Waiver & Segregation of DutiesIts Framework References list this control. Supported by: Parent policy and authority; review.
  • Word

    Policy Framework Standard

    in Security Policy ManagementIts Framework References list this control. Supported by: PF-01 to PF-09: policies defined, approved, published, communicated, acknowledged and reviewed.
  • Word

    Policy Lifecycle Operating Procedure

    in Security Policy ManagementIts Framework References list this control. Supported by: Whole procedure: policies approved, published, communicated, acknowledged and reviewed.
  • Word

    Security Policy Document Template

    in Security Policy ManagementIts Framework References list this control. Supported by: Whole template: policies defined, approved, published, acknowledged and reviewed.
  • Excel

    Security Policy Hierarchy & Document Map

    in Security Policy ManagementIts Framework References list this control. Supported by: Document Map and Hierarchy: policies approved, published and reviewed.
  • Excel

    Policy Register & Review Schedule

    in Security Policy ManagementIts Framework References list this control. Supported by: Policies approved by management, published and reviewed at planned intervals and on significant change: Approval, Next review date, Review trigger.
  • Excel

    Policy Attestation & Acknowledgement Tracker

    in Security Policy ManagementIts Framework References list this control. Supported by: Policies communicated to and acknowledged by relevant personnel: Acknowledgement Log, Status.
  • Excel

    Policy Coverage Gap Assessment

    in Security Policy ManagementIts Framework References list this control. Supported by: Questions 2 and 3: policies approved and reviewed.
  • Word

    ICT Risk Management Framework Document Template

    in DORA ICT Risk & Resilience ReadinessIts Framework References list this control. Supported by: Policies approved by the management body and reviewed on a plan (FW-05, FW-24).
  • Word

    AI Acceptable Use & Security Policy

    in AI Security Governance & Acceptable UseIts Framework References list this control. Supported by: Policy statements; Document control; Review (AG-19).