ISO 27001 Control A.5.1: Policies for Information Security

Every other control in Annex A eventually points back to a rule written down somewhere. Who may enter the server room, how long footage is kept, what happens to old laptops. A.5.1 is where those rules get their home. It is the first of 37 organizational controls in our walk through Annex A, and after finishing the physical controls we turn to the theme that sets direction for everything else.

Policies have a bad reputation, and often a deserved one: forty-page documents written once, signed by someone senior, and never opened again. The point of this control is the opposite. A good policy set is short, owned, communicated and kept alive. It tells people what the organization expects and why, in language they can follow on a busy day.

What the control requires

Annex A control 5.1 of ISO 27001:2022 states that information security policy and topic-specific policies shall be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur.

The key elements:

Information security policy - the top-level statement of intent, direction and commitment, aligned with the policy required by Policy in clause 5.2
Topic-specific policies - focused rules for particular subjects, such as access control, clear desk and clear screen, backup, cryptography, supplier relationships or remote working
Approved by management - signed off by people with the authority to commit the organization
Published and communicated - available to those who need it, and actively brought to their attention
Acknowledged - relevant personnel and interested parties confirm that they have received and understood the policies
Reviewed at planned intervals and if significant changes occur - scheduled reviews, plus reviews triggered by change

A.5.1 is a preventive control in ISO/IEC 27002:2022. Annex A states the control; ISO 27002 gives guidance, including that the top-level policy should reflect business strategy, regulations and the current and projected threat environment, and that topic-specific policies should be assigned an owner with approved responsibility for development, review and evaluation. The guidance also lists the sorts of topics worth considering, which is a useful checklist rather than a mandatory list. Which topics you need depends on your own risks.

How to implement policies for information security

Separate the layers and keep each short

Think in three layers. The top is the information security policy: a page or two stating why security matters to the organization, what it aims to achieve, and that management commits to meeting requirements and improving continually. The middle is the set of topic-specific policies, each covering one subject in a page or so. The bottom is procedures and work instructions, which say how to carry out the policy step by step. Keeping these apart makes everything easier to maintain. A policy states what and why; a procedure states how, and changes more often.

For a small organization, a dozen short topic policies are plenty. For example: access control, acceptable use, clear desk and clear screen, remote working, information classification and handling, backup, supplier security, incident reporting, change management and cryptography. Add others when your risks call for them. The physical series we have just covered suggests several candidates already, from rules on clear desk and clear screen to rules on storage media.

Write for the reader

Use plain language, short sentences and concrete examples. State who the policy applies to, what is required, what is not allowed, and where to go with questions. Avoid copying templates word for word; a policy that describes controls you do not have is a liability, because an auditor will compare the text with reality. If the policy says that all laptops are encrypted, then all laptops must be. Write what you do, and improve it where you want to do better.

Give each policy an owner, a version, an approval date and a review date. These details support the document-control expectations in Creating and updating and Control of documented information, so you only have to get the housekeeping right once.

Approve, publish and make people acknowledge

Management approval should be visible: a named approver, a date and a record, such as meeting minutes or a signature in your document system. Publish the policies in a place people already use, like the intranet or shared drive, not in a folder known only to the security lead. Communicate when something new or changed arrives, with a short summary of what is different and why.

Acknowledgement can be simple. A click-to-confirm in the onboarding system, a periodic attestation, or a signed statement at induction all work. Remember the second audience in the control: relevant interested parties. Contractors, suppliers and partners who touch your information also need to see the relevant rules, which links to the thinking in confidentiality or non-disclosure agreements and to the terms in your contracts. Policies come to life through information security awareness, education and training, where examples and discussion do what a PDF cannot.

Review on a schedule and when things change

Set a review cycle, typically yearly, and record it. Also review when something significant changes: a new product, a merger, a major incident, a change in law, a move to a new cloud platform. Feed the review into your management review so leadership sees whether the policy set still fits. Track exceptions and breaches, since a rule that is often broken may be unrealistic and needs a conversation. Where breaches are deliberate or repeated, the disciplinary process gives you a fair route to follow.

Clause 5.1 connection. Leadership and commitment is where top management demonstrates support for the policy set.

Clause 5.2 connection. Policy requires the top-level information security policy that this control puts into practice.

Clause 7.5 connection. Creating and updating and Control of documented information govern the identification, approval, versioning and availability of your policy documents.

Clause 9.3 connection. Management review is the natural place to review whether the policies still serve the organization.

A.6.3 connection. Information security awareness, education and training is how personnel come to understand and follow the policies.

A.6.4 connection. Disciplinary process is the route for handling policy breaches.

A.7.7 connection. Clear desk and clear screen is a good example of a topic that benefits from its own short policy.

Forward reference. Information security roles and responsibilities (A.5.2) comes next, and decides who owns each policy, while the later control on compliance with policies, rules and standards for information security (A.5.36) checks that people follow them.

What auditors check

The top-level policy. Auditors look for a current information security policy that is approved, dated and consistent with your objectives and context.

Topic-specific policies. They check that policies exist for the subjects that matter to your risks, and that they match what the organization actually does.

Approval and version history. Expect requests for evidence of management approval, document versions and review dates.

Communication and acknowledgement. Auditors ask how personnel and relevant external parties receive the policies, and look at acknowledgement records.

Staff awareness. In interviews they test whether people know where the policies are and can describe the ones relevant to their work.

Review. They look for evidence of planned reviews and of reviews after significant changes, including links to management review.

Common mistakes to avoid

Copied templates that do not match reality. A policy promising controls you do not operate creates a nonconformity from your own words.

One enormous document. A single handbook is hard to maintain and nobody reads it. Split by topic and keep each part short.

Policies without owners. An unowned document goes stale. Name a person for each one.

No acknowledgement. Publishing is not communicating. Keep a simple record that people have seen and understood the rules.

Forgetting external parties. Contractors and suppliers need the relevant rules too, not only employees.

Review in name only. Changing the date on the front page without reading the content is easy to spot. Make reviews real, and record what changed.

Policy as a substitute for action. A rule with no training, no tooling and no checking is a hope. Back each policy with the means to follow it.

How 27kay can help

We help organizations build policy sets that are short, honest and actually used, from the top-level statement through to the topic policies that fit your risks. As part of ISO 27001 implementation, we draft with you rather than for you, align the documents with your real practice, and set up approval, acknowledgement and review so the evidence looks after itself. For the full picture, see our ISO 27001 knowledge hub.

If a new colleague asked where your security rules live, could you show them in under a minute? Get in touch - we will help you make that an easy question to answer.