Learn · Information Security
What Is an Information
Security Policy?
An information security policy is the formal document that sets out how an organisation protects its information — the rules, roles, and expectations for keeping data confidential, accurate, and available.
It’s the top-level document of a security programme — and ISO 27001 (Clause 5.2) makes having one a requirement. A good policy is short, approved by leadership, and backed by more detailed supporting policies.
Plain-English explainer · Aligned to ISO 27001 Clause 5.2 / Annex A 5.1 · Last reviewed June 2026
An information security policy is a formal, management-approved document that defines how an organisation protects its information assets. It states the organisation’s commitment to security, sets the rules and responsibilities everyone must follow, and gives direction for protecting the confidentiality, integrity, and availability of data. In practice it’s usually a concise top-level statement supported by more detailed policies — acceptable use, access control, data classification, and so on. It’s the foundation of an ISMS: ISO 27001 Clause 5.2 explicitly requires top management to establish an information security policy, and Annex A expects a full set of supporting policies. SOC 2 and India’s DPDP Act expect documented policies too.
What It Covers
The Core Elements
Purpose & scope
Why the policy exists and what it covers — which systems, data, people, and locations it applies to.
Roles & responsibilities
Who owns security, who approves the policy, and what every employee is responsible for.
Access control
How access to systems and data is granted, reviewed, and revoked — least privilege and authentication.
Data classification
How information is labelled (e.g., Public, Internal, Confidential) and handled at each level.
Incident response
How security incidents are reported, escalated, and handled — and who to tell.
Compliance & enforcement
The laws and standards the organisation must meet, and the consequences of breaking the policy.
What Makes One Work
A Policy That’s Actually Followed
A policy nobody reads protects nothing. The difference between a shelf document and a real control comes down to a few things:
- Approved by top management — it carries authority only if leadership signs off and visibly backs it.
- Communicated to everyone — staff must know it exists, where to find it, and what it asks of them.
- Clear and usable — written so people can actually follow it, not buried in jargon.
- Reviewed regularly — re-examined at planned intervals and after major changes, so it stays current.
- Supported by detailed policies — a short top-level statement, backed by specific policies (acceptable use, access control, etc.).
Information Security Policy — Common Questions
The questions people ask most about information security policies.
What is an information security policy?
An information security policy is a formal, management-approved document that sets out how an organisation protects its information — the rules, roles, and expectations for keeping data confidential, accurate (integrity), and available. It’s the top-level document that directs a security programme.
What should an information security policy include?
At minimum: purpose and scope, roles and responsibilities, access control, data classification and handling, incident response, and compliance and enforcement. The top-level policy is usually short and backed by detailed supporting policies such as acceptable use and access control.
Does ISO 27001 require an information security policy?
Yes. ISO 27001 Clause 5.2 requires top management to establish an information security policy that fits the organisation’s purpose, includes security objectives, and commits to meeting requirements and to continual improvement. Annex A also expects a set of supporting topic-specific policies.
What is the difference between a policy, a standard, and a procedure?
A policy states what the organisation requires and why (high-level intent). A standard specifies the mandatory rules that meet the policy (e.g., minimum password length). A procedure is the step-by-step of how to do a task. Policies set direction; standards and procedures make them operational.
How often should an information security policy be reviewed?
It should be reviewed at planned intervals — commonly at least annually — and whenever significant changes occur (new systems, regulations, incidents, or business changes). Regular review keeps it relevant, and ISO 27001 expects evidence that review happens.
Related reading: the Learn hub, what an ISMS is, access control, and GRC. More terms in the compliance glossary.
Written By Expert Auditors
Get in touch
Book a free consultation or send us your requirements. We respond within 24 hours.
Quick Call
Pick a time slot
Send Requirements
Get a custom quote in 24 hours