ISO 27001 - Annex A.5: Information Security Policies

A.5.1.1 Policies for Information Security

A set of policies for information security must be defined, approved by management, published and communicated to employees and relevant external parties. The policies must be led by business needs, alongside the applicable regulations and legislation affecting the organisation too.  These policies in effect are the Annex A controls, also summarised up into a higher level master information security policy document that reinforces the organisation’s key statements around security to share with stakeholders like customers. That overarching policy becomes much more believable and powerful with independent certification for ISO 27001:2013 from UKAS behind it.

Policies also provide the backbone of information security and should be part of the education, training and awareness programme in line with A7.2.2. The policies set out the principles that members of the organisation and key parties like suppliers must follow.   These policies need to be reviewed regularly and updated when necessary in line with A.5.1.2 below.

A.5.1.2 Review of the policies for information security

The policies for information security need to be reviewed at planned intervals, or if significant changes occur, to ensure their continuing suitability, adequacy and effectiveness. Whenever changes are made to the business, its risks & issues, technology or legislation & regulation or if security weaknesses, events or incidents indicate a need for policy change.

Policies must be also reviewed and updated on a regular basis.  ISO considers ‘regular’ to be at least annually, which can be hard work if you are manually managing that many reviews and also dovetailing it with the independent review as part of A.18.2.1.

In addition to many other features, ISMS.online includes visible and automated processes to help simplify that whole review requirement and save huge amounts of admin time versus other ways of working.

ISMS.online gives you actionable ISO 27001 policies and controls to give you this great head start…

“Our staff immediately took to the ISMS.online platform and it has really expedited our route to achieving ISO 27001 and GDPR. The Policy Pack feature makes it easy to track who has read company policies, giving us an instant audit trail documenting compliance – a big tick in the box when it comes to our audit for ISO 27001!”

Sandra Lewy – Director, Business Operations and Research Coordinator at IACCM