Control A.5.1Policies for information security
The organisation’s information security policy and its topic-specific policies must be defined, approved by management, published, communicated to and acknowledged by the people they apply to, and reviewed at planned intervals and when significant changes occur.
Two layers, and conflating them is the most common mistake. The information security policy is the single high-level statement clause 5.2 requires of top management. Topic-specific policies sit beneath it — access control, cryptography, acceptable use, secure development, supplier security — and are approved at the level appropriate to their subject.
The requirement that is hardest to evidence is acknowledgement by the relevant personnel. A policy published on an intranet has been made available; that is not the same thing, and an auditor asking a member of staff which policies apply to their work is testing exactly this.
Review “when significant changes occur” is the part that decays first. A policy set reviewed annually by calendar and never by event will describe an organisation that has moved on.
How to put this in place
An ISMS project needs one approved policy that sets direction, because every later rule, risk decision and audit question points back to it. Without it, teams make up their own rules and nobody can show what management actually asked for.
- Decide which topics your risks need a policy for, and keep the list short.
- Draft a top-level policy and the topic policies in plain words, each with an owner.
- Get top management to approve the top-level policy and record the approval.
- Publish the set in one place and collect acknowledgements from staff and contractors.
- Set a review date for each policy and record every review, even when nothing changes.
Evidence an auditor usually looks for: the approved policy set with versions and approval dates, acknowledgement records for a sample of staff, and the record of the last review.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists the information security policy and the topic-specific policies among the documents auditors commonly expect for this control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.