---
notetype: reference
standard: ISO 27001
version: 2022
language: EN
type: clause
id: "C.5.2"
title: "Policy"
tags:
- iso27001/2022/EN
- sourcetext
status: active
---
## 5.2 Policy

Top management shall establish an information security policy that:

a\) is appropriate to the purpose of the organization;

b\) includes information security objectives (see [6.2](ISO_27001_OT%206.2%20Information%20security%20objectives%20and%20planning%20to%20achieve%20them.md)) or provides the framework for setting information security objectives;

c\) includes a commitment to satisfy applicable requirements related to information security;

d\) includes a commitment to continual improvement of the information security management system. The information security policy shall:

e\) be available as documented information;

f\) be communicated within the organization;

g\) be available to interested parties, as appropriate.