#iso27002/2022/EN
## 5.1 Policies for information security

#### Control
Information security policy and topic-specific policies should be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur.

#### Purpose
To ensure continuing suitability, adequacy, effectiveness of management direction and support for information security in accordance with business, legal, statutory, regulatory and contractual requirements.

#### Guidance
At the highest level, the organization should define an “information security policy” which is approved by top management and which sets out the organization’s approach to managing its information security.

The information security policy should take into consideration requirements derived from:

a) business strategy and requirements;
b) regulations, legislation and contracts;
c) the current and projected information security risks and threats. 

The information security policy should contain statements concerning:

a) definition of information security;
b) information security objectives or the framework for setting information security objectives;
c) principles to guide all activities relating to information security;
d) commitment to satisfy applicable requirements related to information security;
e) commitment to continual improvement of the information security management system;
f) assignment of responsibilities for information security management to defined roles;
g) procedures for handling exemptions and exceptions.

Top management should approve any changes to the information security policy.

At a lower level, the information security policy should be supported by topic-specific policies as needed, to further mandate the implementation of information security controls. Topic-specific policies are typically structured to address the needs of certain target groups within an organization or to cover certain security areas. Topic-specific policies should be aligned with and complementary to the information security policy of the organization.

Examples of such topics include:

a) access control;
b) physical and environmental security;
c) asset management;
d) information transfer;
e) secure configuration and handling of user endpoint devices;
f) networking security;
g) information security incident management;
h) backup;
i) cryptography and key management;
j) information classification and handling;
k) management of technical vulnerabilities;
l) secure development.

The responsibility for the development, review and approval of the topic-specific policies should be allocated to relevant personnel based on their appropriate level of authority and technical competency. The review should include assessing opportunities for improvement of the organization’s information security policy and topic-specific policies and managing information security in response to changes to:

a) the organization’s business strategy;
b) the organization’s technical environment;
c) regulations, statutes, legislation and contracts;
d) information security risks;
e) the current and projected information security threat environment;
f) lessons learned from information security events and incidents.

The review of information security policy and topic-specific policies should take the results of management reviews and audits into account. Review and update of other related policies should be considered when one policy is changed to maintain consistency.

The information security policy and topic-specific policies should be communicated to relevant personnel and interested parties in a form that is relevant, accessible and understandable to the intended reader. Recipients of the policies should be required to acknowledge they understand and agree to comply with the policies where applicable. The organization can determine the formats and names of these policy documents that meet the organization’s needs. In some organizations, the information security policy and topic-specific policies can be in a single document. The organization can name these topic-specific policies as standards, directives, policies or others.

If the information security policy or any topic-specific policy is distributed outside the organization, care should be taken not to improperly disclose confidential information.

Table 1 illustrates the differences between information security policy and topic-specific policy.   

*Table 1* | Information security policy | Topic-specific policy
------- | --------------------------- | ---------------------
Level of detail | General or high-level | Specific and detailed
Documented and formally approved by | Top management | Appropriate level of management


#### Other information
Topic-specific policies can vary across organizations.


# Related
- [[ISO_27002_PE 5.1 Policies for information security]]

