Policy
Top management must set an information security policy that suits the organization's purpose; states the security objectives (6.2) or gives a framework for setting them; commits to meeting applicable information security requirements;....
What the requirement asks
Top management must set an information security policy that suits the organization's purpose; states the security objectives (6.2) or gives a framework for setting them; commits to meeting applicable information security requirements; and commits to continually improving the ISMS. The policy must exist as documented information, be communicated inside the organization, and be available to interested parties where appropriate.
What the guidance adds
The policy is expected to give direction a team can act on: what information security means here, the objectives or how they are set, the commitments, the roles and the exception route. The guidance also asks how the policy is communicated and how a reader can tell that it is current.
Status of the guidance. The guidance lens for 5.2 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep the approved information security policy signed off by top management with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- Information security policyThe approved information security policy signed off by top management
- Information security policyPolicy text showing objectives or an objective-setting framework and the two commitments (to requirements and to continual improvement)
- Information security policyCommunication records such as intranet publication, induction material or acknowledgements
- Information security policyEvidence of availability to interested parties where appropriate, for example a public summary or supplier distribution
The question an assessor will ask
An assessor will ask for the approved information security policy signed off by top management. The test for 5.2 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- The policy lacks the commitment to continual improvement or to meeting requirements
- Objectives are neither stated nor given a framework
- Staff cannot find or have never seen the policy
- The policy was approved by someone other than top management
Before the next audit
Before the next audit, test this against one live record: the policy lacks the commitment to continual improvement or to meeting requirements.