An information security policy is the formal document that sets out how an organisation protects its information — the rules, roles, and expectations for keeping data confidential, accurate, and available.
It’s the top-level document of a security programme — and ISO 27001 (Clause 5.2) makes having one a requirement. A good policy is short, approved by leadership, and backed by more detailed supporting policies.
Plain-English explainer · Aligned to ISO 27001 Clause 5.2 / Annex A 5.1 · Last reviewed June 2026
An information security policy is a formal, management-approved document that defines how an organisation protects its information assets. It states the organisation’s commitment to security, sets the rules and responsibilities everyone must follow, and gives direction for protecting the confidentiality, integrity, and availability of data. In practice it’s usually a concise top-level statement supported by more detailed policies — acceptable use, access control, data classification, and so on. It’s the foundation of an ISMS: ISO 27001 Clause 5.2 explicitly requires top management to establish an information security policy, and Annex A expects a full set of supporting policies. SOC 2 and India’s DPDP Act expect documented policies too.
Key Takeaways
- An information security policy is a management-approved document defining how an organisation protects its information.
- It exists to safeguard the confidentiality, integrity, and availability of data, and to set clear rules and responsibilities.
- Typical structure: a short top-level policy plus supporting policies (acceptable use, access control, data classification, incident response).
- ISO 27001 Clause 5.2 requires one. It must be approved by leadership, communicated to staff, and reviewed regularly.
The Core Elements
Purpose & scope
Why the policy exists and what it covers — which systems, data, people, and locations it applies to.
Roles & responsibilities
Who owns security, who approves the policy, and what every employee is responsible for.
Access control
How access to systems and data is granted, reviewed, and revoked — least privilege and authentication.
Data classification
How information is labelled (e.g., Public, Internal, Confidential) and handled at each level.
Incident response
How security incidents are reported, escalated, and handled — and who to tell.
Compliance & enforcement
The laws and standards the organisation must meet, and the consequences of breaking the policy.
A Policy That’s Actually Followed
A policy nobody reads protects nothing. The difference between a shelf document and a real control comes down to a few things:
- Approved by top management — it carries authority only if leadership signs off and visibly backs it.
- Communicated to everyone — staff must know it exists, where to find it, and what it asks of them.
- Clear and usable — written so people can actually follow it, not buried in jargon.
- Reviewed regularly — re-examined at planned intervals and after major changes, so it stays current.
- Supported by detailed policies — a short top-level statement, backed by specific policies (acceptable use, access control, etc.).
Information Security Policy — Common Questions
The questions people ask most about information security policies.
What is an information security policy?
What should an information security policy include?
Does ISO 27001 require an information security policy?
What is the difference between a policy, a standard, and a procedure?
How often should an information security policy be reviewed?
Related reading: the Learn hub, what an ISMS is, access control, and GRC. More terms in the compliance glossary.
Related Reading
ISO 27001 Knowledge Hub
All 93 Annex A controls, all clauses, every guide in the cluster.
Read moreMandatory Documents
The documents and records ISO 27001:2022 requires you to maintain.
Read moreAnnex A Controls Overview
All 93 controls across organizational, people, physical and tech domains.
Read moreISO 27001 Clauses (4–10)
All 23 ISMS clauses explained — from context to continual improvement.
Read moreISO 27001 Templates
ISMS policy templates, SoA workbook, risk register, and audit checklists.
Read moreSOC 2 Controls List
No official list exists — illustrative controls by criteria series (CC1–CC9).
Read more