Security Policy Hierarchy & Document Map

Shows which documents a given organisation size and regulatory profile actually needs, and how each maps to ISO 27001 and NIS2 obligations.

Available soon

Format: Excel
Size: 62 KB
Length: 10 sheets
Version: 1.0
Updated: 28 Sep 2026

What's inside

Instructions
Choose Your Profile
Document Map
Hierarchy
Lists
Definitions
Framework References

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Choose Your Profile: pick your profile in cell D5. Core: every organisation, including a small one with IT run by a provider. Growing: over about [[50]] people. Regulated: an essential or important entity under NIS2, or a financial entity under DORA.
2	Answer D6: do you develop or change software in-house? 'Yes' adds PT-12 Secure development and change management to the list whatever the profile (it is already in Growing and Regulated).
3	Read the list below the choices. It shows each document you need, grouped by tier (Policy, Standard, Procedure), with the approver and the longest review interval for that tier from the Hierarchy sheet, and the count for each tier.
4	Document Map: in 'Your document', write the reference and title of the document that covers each topic today (for example 'ISP-001 Information Security Policy'). Leave it blank where you have none: that is a gap. The Policy Coverage Gap Assessment takes it from there.
5	Where a topic does not fit your organisation, or you need one the profile leaves out, set 'Include?' to Include or Exclude and write the reason. 'By profile' follows the profile. Exclusions need a reason an auditor would accept (for example 'no premises: all staff remote, no equipment rooms').
6	The tier is the one recommended for the topic. You may change it (for example cover backup inside a Standard your IT provider runs), but keep one tier per document (PF-01) and record why in the reason column.
7	Delete the EXAMPLE entries in the column 'Example organisation's document' once you have filled your own, and set D5 and D6 to your own answers.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

The worked example. D5 and D6 on Choose Your Profile hold the example organisation's answers (a software services company with 240 staff in two offices, an NIS2 important entity): profile Regulated, develops software in-house. The Document Map's EXAMPLE column shows the documents from its register that cover each topic, as at 2026-09-30. The register is an excerpt: a topic 'not in the excerpt' may still be covered.

Framework columns. ISO/IEC 27001:2022 controls are given by Annex A number only (or clause number), as identifiers; the standard's titles are not reproduced except those on the Framework References sheet. NIS2 points are the letters of Article 21(2); the wording of (a), (f) and (g) is on the Framework References sheet, and the other letters are identifiers only. DORA points are the letters of Article 2(2) of Delegated Regulation (EU) 2024/1774 and apply to financial entities under DORA; they are quoted on the Framework References sheet.

A document may cover more than one topic (for example acceptable use and remote working in one policy), and one topic may need more than one document. What matters is that each topic is covered once, at the right tier, by an approved and current document.

Tailoring — small organisation: the Core set is the minimum. Several topics can share one short document, provided each has an owner and a review date. A standard can be a one-page table.

Tailoring — regulated entity (NIS2, DORA): the management body approves the cybersecurity risk-management measures (NIS2 Art 20(1)); under DORA, each ICT security policy carries the date of its approval by the management body and lists the documentation to be maintained (RTS Art 2(2)(b), (f)). This map, kept current, is that list.

Tailoring — IT run by a service provider: the provider's own documents may cover operational topics (backup, patching, logging). Record the provider's document in 'Your document', check the contract makes it binding, and keep ownership of the topic in your organisation: a provider can run a standard but cannot own your policy.

Choose Your Profile

Choose your profile

Pick your profile and answer the development question. The list below shows the documents you need, grouped by tier. Yellow cells are yours; everything else calculates.

Your profile		Regulated	EXAMPLE — the example organisation is Regulated (an NIS2 important entity). Choose yours.
Do you develop software in-house?		Yes	EXAMPLE — a software services company. 'Yes' adds PT-12 to any profile.

The three profiles

Profile	Topics	Who it is for
Core	7	Every organisation, including a small one whose IT is run by a provider.
Growing	15	Over about [[50]] people. Adds the Growing topics to Core.
Regulated	18	An NIS2 essential or important entity, or a DORA financial entity. Adds continuity, risk management and effectiveness assessment.

Topic counts follow the profile alone; the list below also applies the development answer and any Include or Exclude on the Document Map.

What you need

Documents needed	18	For the Regulated profile, with in-house development: 18 topics, of which 0 already have a document named in 'Your document'.
Policy tier	9	Approved by: Executive management (the management body, or its delegate for the top policy). Reviewed at least every 12 months.
Standard tier	8	Approved by: Head of Information Security (the document owner is consulted). Reviewed at least every 12 months.
Procedure tier	1	Approved by: Head of Information Security (the process owner is consulted). Reviewed at least every 24 months.
Guideline tier	0	Approved by: Information security. Reviewed at least every 24 months.

The documents you need, grouped by tier

No.	Tier	Topic ID	Topic	Approved by	Review at least every (months)	Needed from	Your document (from the Document Map)	Map row	Tier (working)
1	Policy	PT-01	Information security policy (the top policy)	Executive management (the management body, or its delegate for the top policy)	12	Core	EXAMPLE — ISP-001 Information Security Policy v3.0 (Approved)	1	Policy
2		PT-02	Acceptable use of information and technology	Executive management (the management body, or its delegate for the top policy)	12	Core	EXAMPLE — AUP-001 Acceptable Use Policy v2.1 (Review overdue)	2	Policy
3		PT-03	Access control and identity	Executive management (the management body, or its delegate for the top policy)	12	Core	EXAMPLE — ACP-001 Access Control Policy v2.0 (Approved)	3	Policy
4		PT-04	Asset management and information classification	Executive management (the management body, or its delegate for the top policy)	12	Core	EXAMPLE — not in the example register excerpt	4	Policy
5		PT-05	Incident management	Executive management (the management body, or its delegate for the top policy)	12	Core	EXAMPLE — INC-001 Incident Management Policy v1.2 (Approved)	5	Policy
6		PT-08	Supplier and third-party security	Executive management (the management body, or its delegate for the top policy)	12	Growing	EXAMPLE — SUP-001 Supplier Security Policy v1.0 (Awaiting approval)	8	Policy
7		PT-14	People security (joiners, movers, leavers, training)	Executive management (the management body, or its delegate for the top policy)	12	Growing	EXAMPLE — JML-PRC Joiner, Mover, Leaver Procedure v2.2 (Approved): a Procedure, where the map recommends a Policy	14	Policy
8		PT-16	Business continuity and ICT resilience	Executive management (the management body, or its delegate for the top policy)	12	Regulated	EXAMPLE — not in the example register excerpt	16	Policy
9		PT-17	Information security risk management	Executive management (the management body, or its delegate for the top policy)	12	Regulated	EXAMPLE — not in the example register excerpt	17	Policy
10	Standard	PT-06	Backup and recovery	Head of Information Security (the document owner is consulted)	12	Core	EXAMPLE — BKP-001 Backup Standard v1.3 (Review overdue)	6	Standard
11		PT-07	Vulnerability and patch management	Head of Information Security (the document owner is consulted)	12	Core	EXAMPLE — VMS-001 Vulnerability & Exposure Management Standard v1.0 (Approved)	7	Standard
12		PT-09	Remote working and mobile devices	Head of Information Security (the document owner is consulted)	12	Growing	EXAMPLE — RMT-GDL Remote Working Guideline v1.1 (Approved): a Guideline, where the map recommends a Standard	9	Standard
13		PT-10	Cryptography and key management	Head of Information Security (the document owner is consulted)	12	Growing	EXAMPLE — not in the example register excerpt	10	Standard
14		PT-11	Logging and monitoring	Head of Information Security (the document owner is consulted)	12	Growing	EXAMPLE — not in the example register excerpt	11	Standard
15		PT-12	Secure development and change management	Head of Information Security (the document owner is consulted)	12	Growing	EXAMPLE — not in the example register excerpt	12	Standard
16		PT-13	Physical and environmental security	Head of Information Security (the document owner is consulted)	12	Growing	EXAMPLE — not in the example register excerpt	13	Standard
17		PT-15	Security exceptions and waivers	Head of Information Security (the document owner is consulted)	12	Growing	EXAMPLE — EXC-STD Security Exception & Waiver Standard v1.0 (Approved)	15	Standard
18	Procedure	PT-18	Effectiveness assessment of security measures	Head of Information Security (the process owner is consulted)	24	Regulated	EXAMPLE — not in the example register excerpt	18	Procedure

Empty rows at the foot of the list mean your profile needs fewer documents than there are topics. The two grey columns are working columns for the list: do not type in them.

Document Map

One row per policy topic. Yellow columns are yours. NIS2 (a), (f), (g) and the DORA points are quoted on the Framework References sheet; ISO/IEC 27001 numbers are identifiers only. Rows marked EXAMPLE show the example organisation's documents.

Topic ID	Topic	Tier (recommended)	Needed from profile	What it must cover	Why from this profile	ISO/IEC 27001:2022 controls (numbers)	NIS2 Art 21(2) points	DORA RTS 2024/1774 Art 2(2) points	Example organisation's document (EXAMPLE)	Include?	Needed for your profile?	List order	Sort key
PT-01	Information security policy (the top policy)	Policy	Core	Management's commitment, the security objectives, who is accountable, and the list of documents that implement it.	Every organisation needs one top policy: it is the document every other one hangs from.	A.5.1, A.5.2, A.5.4	(a)	(b), (d), (e), (f)	EXAMPLE — ISP-001 Information Security Policy v3.0 (Approved)	By profile	Yes	1	1004
PT-02	Acceptable use of information and technology	Policy	Core	What people may and may not do with company information, devices, email, internet and cloud services.	Everyone uses information and devices; the rules must be written down and acknowledged from day one.	A.5.10, A.8.1	(g), (i)	(d), (e)	EXAMPLE — AUP-001 Acceptable Use Policy v2.1 (Review overdue)	By profile	Yes	2	1005
PT-03	Access control and identity	Policy	Core	How access is requested, approved, reviewed and removed; authentication and privileged access.	Access is the most common route for an attacker and the most common audit finding.	A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, A.8.3, A.8.5	(i), (j)	—	EXAMPLE — ACP-001 Access Control Policy v2.0 (Approved)	By profile	Yes	3	1006
PT-04	Asset management and information classification	Policy	Core	How information and assets are listed, owned, classified, labelled and returned.	You cannot protect what you have not listed, or decide how well without a classification.	A.5.9, A.5.11, A.5.12, A.5.13	(i)	—	EXAMPLE — not in the example register excerpt	By profile	Yes	4	1007
PT-05	Incident management	Policy	Core	How incidents are reported, assessed, handled, escalated, notified and learned from.	Every organisation will have incidents; staff must know how to report one and who decides.	A.5.24, A.5.25, A.5.26, A.5.27, A.5.28, A.6.8	(b)	—	EXAMPLE — INC-001 Incident Management Policy v1.2 (Approved)	By profile	Yes	5	1008
PT-06	Backup and recovery	Standard	Core	What is backed up, how often, how copies are protected and how restores are tested.	Backups are the last defence against ransomware and failure, and are only as good as the last restore test.	A.8.13	(c)	—	EXAMPLE — BKP-001 Backup Standard v1.3 (Review overdue)	By profile	Yes	10	2009
PT-07	Vulnerability and patch management	Standard	Core	How vulnerabilities are found, prioritised and fixed within deadlines, and how exceptions are approved.	Unpatched systems are exploited in organisations of every size.	A.8.8, A.8.19	(e)	—	EXAMPLE — VMS-001 Vulnerability & Exposure Management Standard v1.0 (Approved)	By profile	Yes	11	2010
PT-08	Supplier and third-party security	Policy	Growing	How suppliers are assessed, what contracts require, and how supplier security is monitored.	As an organisation grows it relies on more suppliers and cloud services holding its data.	A.5.19, A.5.20, A.5.21, A.5.22, A.5.23	(d)	—	EXAMPLE — SUP-001 Supplier Security Policy v1.0 (Awaiting approval)	By profile	Yes	6	1011
PT-09	Remote working and mobile devices	Standard	Growing	Security for working away from the office and for laptops and phones, company-owned or personal.	Needed once people work from several places on several devices.	A.6.7, A.7.9, A.8.1	(g), (j)	—	EXAMPLE — RMT-GDL Remote Working Guideline v1.1 (Approved): a Guideline, where the map recommends a Standard	By profile	Yes	12	2012
PT-10	Cryptography and key management	Standard	Growing	Where encryption is required, which methods are allowed, and how keys are created, stored and retired.	Needed once the organisation runs its own systems that store or transmit sensitive data.	A.8.24	(h)	—	EXAMPLE — not in the example register excerpt	By profile	Yes	13	2013
PT-11	Logging and monitoring	Standard	Growing	What is logged, how long logs are kept, who reviews them, and what raises an alert.	Needed once there are enough systems that incidents are found only by watching for them.	A.8.15, A.8.16, A.8.17	(b)	—	EXAMPLE — not in the example register excerpt	By profile	Yes	14	2014
PT-12	Secure development and change management	Standard	Growing	Security in the development life cycle, testing, separation of environments and changes to live systems.	Needed by anyone who builds or changes software, including a small development team.	A.8.25, A.8.26, A.8.27, A.8.28, A.8.29, A.8.30, A.8.31, A.8.32	(e)	—	EXAMPLE — not in the example register excerpt	By profile	Yes	15	2015
PT-13	Physical and environmental security	Standard	Growing	Protection of offices, server and network rooms, equipment and utilities.	Needed once the organisation has its own premises or equipment rooms to protect.	A.7.1 to A.7.14	(a)	—	EXAMPLE — not in the example register excerpt	By profile	Yes	16	2016
PT-14	People security (joiners, movers, leavers, training)	Policy	Growing	Screening, terms of employment, awareness training, discipline, and joiners, movers and leavers.	Needed once hiring, role changes and leavers are too frequent to handle case by case.	A.6.1, A.6.2, A.6.3, A.6.4, A.6.5, A.6.6	(g), (i)	(d), (e)	EXAMPLE — JML-PRC Joiner, Mover, Leaver Procedure v2.2 (Approved): a Procedure, where the map recommends a Policy	By profile	Yes	7	1017
PT-15	Security exceptions and waivers	Standard	Growing	How a deviation from any document is requested, risk-assessed, approved, time-limited and recorded.	Needed once there are enough rules that some cannot always be met; without it, deviations happen informally.	A.5.36	(a)	(c)	EXAMPLE — EXC-STD Security Exception & Waiver Standard v1.0 (Approved)	By profile	Yes	17	2018
PT-16	Business continuity and ICT resilience	Policy	Regulated	How critical services keep running or recover within set times, and how the plans are tested.	Regulators expect a documented, tested continuity and ICT resilience arrangement.	A.5.29, A.5.30, A.8.14	(c)	—	EXAMPLE — not in the example register excerpt	By profile	Yes	8	1019
PT-17	Information security risk management	Policy	Regulated	How security risks are identified, analysed, evaluated, treated and accepted, and by whom.	NIS2 and DORA require a documented risk-based approach, approved by the management body.	Clauses 6.1.2, 6.1.3, 8.2, 8.3	(a)	(j), (k)	EXAMPLE — not in the example register excerpt	By profile	Yes	9	1020
PT-18	Effectiveness assessment of security measures	Procedure	Regulated	How the effectiveness of security measures is tested and measured, and how results reach management.	NIS2 requires policies and procedures to assess effectiveness; DORA requires indicators to monitor policies.	Clause 9.1; A.5.35, A.5.36	(f)	(c)	EXAMPLE — not in the example register excerpt	By profile	Yes	18	3021

Hierarchy

The four tiers of security documents, top to bottom. Each document belongs to exactly one tier and says which on its first page (PF-01).

Tier	What it is for	Mandatory to follow?	Approved by (PF-03)	Reviewed at least every (months, PF-06)	Topics at this tier in the map	Needed for your profile
Policy	What the organisation commits to and why. Short, stable, written for everyone.	Yes	Executive management (the management body, or its delegate for the top policy)	12	9	9
Standard	The specific, measurable requirements that make a policy real: settings, deadlines, minimums.	Yes	Head of Information Security (the document owner is consulted)	12	8	8
Procedure	How a task is done, step by step, by named roles.	Yes	Head of Information Security (the process owner is consulted)	24	1	1
Guideline	Recommended practice. Helpful, not mandatory; nobody is non-compliant for not following it.	No	Information security	24	0	0

How the tiers fit together

A policy says what the organisation commits to and why. A standard makes it measurable. A procedure says how, step by step. A guideline helps, but nobody is non-compliant for not following it. A lower tier may never contradict a higher one; where they conflict, the higher tier wins until the lower one is corrected.

The top policy (PT-01) is approved by the management body. Other policies may be approved by a delegate the management body names, and that delegation is written in the top policy. Regulated entities: the management body approves the cybersecurity risk-management measures (NIS2 Art 20(1)), and under DORA every ICT security policy records the date the management body approved it (RTS Art 2(2)(b)).

Only the current approved version is published (PF-08), and the Policy Register & Review Schedule lists every document with its owner, tier, status, version, approval date and next review date (PF-11).

The rules the hierarchy rests on

PF-01: Every security document belongs to exactly one tier (Policy, Standard, Procedure, Guideline) and says which on its first page.

PF-02: Every document has one named owner, accountable for its content and its review.

PF-03: Each tier is approved at the level set for it; a document is not in force until approved and published.

PF-06: Every document is reviewed by its tier's maximum interval, and sooner on any trigger; a review that changes nothing is still recorded.

PF-08: Only the current approved version is published, in one place everyone can reach; superseded versions are withdrawn and archived.

PF-11: The register lists every document with owner, tier, status, version, approval date and next review date, and is the only authoritative list.

What forces a review before the scheduled date (PF-06)

• A major incident, or an incident the document should have prevented

• A material change to the organisation's activities, systems or suppliers

• A change in law, regulation or a contract the document supports

• An audit or assessment finding against the document

• A significant change in the threats the document addresses

Lists

ProfileList	YesNo	IncludeChoice	TierName	TierApprover	TierReview
Core	Yes	By profile	Policy	Executive management (the management body, or its delegate for the top policy)	12
Growing	No	Include	Standard	Head of Information Security (the document owner is consulted)	12
Regulated		Exclude	Procedure	Head of Information Security (the process owner is consulted)	24
			Guideline	Information security	24

Definitions

Definitions

Term	Meaning in this workbook
Topic (PT-nn)	A subject a security document set must cover, such as access control or backup. Stable IDs PT-01 to PT-18 are used across the pack.
Tier	One of Policy, Standard, Procedure, Guideline. The tier sets who approves a document and how often it is reviewed (Hierarchy sheet).
Profile	Core, Growing or Regulated: a rough description of the organisation that decides which topics it needs. Each profile includes the topics of the one before it.
Management body	The board of directors or equivalent governing body. Under NIS2 and DORA it approves, and is accountable for, the organisation's security risk-management measures.
Essential or important entity	An organisation within the scope of NIS2 (Directive (EU) 2022/2555), classified by sector and size. Both must meet Article 21.
Financial entity	An organisation within the scope of DORA (Regulation (EU) 2022/2554), such as a bank, insurer or investment firm.
RTS 2024/1774	Delegated Regulation (EU) 2024/1774, the regulatory technical standards under DORA that set what ICT security policies must contain (Article 2(2)).
Annex A	The list of reference controls in ISO/IEC 27001:2022. Numbers such as A.5.15 are used here as identifiers only.
Include / Exclude	An override on the Document Map: Include adds a topic your profile leaves out; Exclude removes one, with a reason. 'By profile' follows the profile.
Register	The Policy Register & Review Schedule: the only authoritative list of documents (PF-11). This map says what should exist; the register says what does.
EXAMPLE	Values that show a completed workbook for the example organisation (a software services company with 240 staff in two offices, an NIS2 important entity). Replace or delete them.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 5.2 — Policy	Hierarchy: the top policy (PT-01) and its approval
ISO/IEC 27001:2022	Clause 7.5 — Documented information	Whole workbook: the documented information the organisation needs
ISO/IEC 27001:2022	Annex A 5.1 — Policies for information security	Document Map and Hierarchy: policies approved, published and reviewed
NIST CSF 2.0	GV.PO-01 — “Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced”	Choose Your Profile: the policy set follows the organisation's context
NIST CSF 2.0	GV.OC-03 — “Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed”	Document Map: the NIS2 and DORA columns
NIS2 — Directive (EU) 2022/2555	Article 20(1) — management bodies approve the cybersecurity risk-management measures and oversee their implementation	Hierarchy: approval of the top policy by the management body
NIS2 — Directive (EU) 2022/2555	Article 21(2)(a) — “policies on risk analysis and information system security”	Document Map: NIS2 column, point (a)
NIS2 — Directive (EU) 2022/2555	Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”	Document Map: NIS2 column, point (f) (PT-18)
NIS2 — Directive (EU) 2022/2555	Article 21(2)(g) — “basic cyber hygiene practices and cybersecurity training”	Document Map: NIS2 column, point (g)
DORA — Regulation (EU) 2022/2554	Article 9(4)(a) — a documented information security policy with rules to protect the availability, authenticity, integrity and confidentiality of data and assets	Document Map: PT-01 for financial entities
DORA — Delegated Regulation (EU) 2024/1774	Article 2(2)(b) — ICT security policies indicate the date of their formal approval by the management body	Hierarchy and Document Map: RTS column, point (b)
DORA — Delegated Regulation (EU) 2024/1774	Article 2(2)(c) — policies contain indicators to monitor their implementation and record exceptions from it	Document Map: RTS column, point (c) (PT-15, PT-18)
DORA — Delegated Regulation (EU) 2024/1774	Article 2(2)(d) — policies specify the responsibilities of staff at all levels	Document Map: RTS column, point (d)
DORA — Delegated Regulation (EU) 2024/1774	Article 2(2)(e) — policies specify the consequences of non-compliance by staff	Document Map: RTS column, point (e)
DORA — Delegated Regulation (EU) 2024/1774	Article 2(2)(f) — policies list the documentation to be maintained	Whole workbook: the list of documentation to be maintained
DORA — Delegated Regulation (EU) 2024/1774	Article 2(2)(j) — policies are reviewed in accordance with DORA Article 6(5)	Document Map: RTS column, point (j) (PT-17)
DORA — Delegated Regulation (EU) 2024/1774	Article 2(2)(k) — policies take into account material changes to the entity, the threat landscape or legal obligations	Document Map: RTS column, point (k) (PT-17); Hierarchy: review triggers

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA); Delegated Regulation (EU) 2024/1774