Clause 5.2 of ISO/IEC 27001 — titled Policy — mandates that top management must establish, document, and maintain an Information Security Policy that aligns with the organization’s purpose and sets the framework for its Information Security Management System (ISMS).
Content Aspects:
a. Appropriate to the Organization’s Purpose
The policy must reflect your organization's unique context and strategic direction—not be a generic template. It should align with organizational goals, culture, and the specific information security needs you identified.
b. Includes (or Provides a Framework for) Information Security Objectives
The policy should either explicitly state high-level security objectives or outline how those objectives will be defined—as further detailed in Clause 6.2.
c. Commitment to Satisfy Applicable Requirements
This includes legal, regulatory, contractual, and internal obligations relevant to information security.
d. Commitment to Continual Improvement
The policy must explicitly demonstrate top management’s dedication to the ongoing enhancement of the ISMS.
Governance & Accessibility Aspects:
e. Documented Information
The policy must be formally documented and available as part of the organization’s documented information system
f. Approval by Top Management
It must be officially approved and endorsed at the highest level of leadership.
g. Communication Within the Organization
The policy should be communicated to all employees and other relevant parties to ensure awareness and understanding.
h. Availability to Interested Parties (as appropriate)
Depending on context—clients, partners, auditors, regulators—the policy may need to be shared externally.
i. Review and Update (as needed)
To remain effective and relevant, the policy must be reviewed periodically (e. g., annually or following major changes or incidents) and updated when necessary.
