Policy template

Information Security Policy template

This policy exists to set management's direction and commitment for protecting the confidentiality, integrity and availability of information. It applies to all information, systems, sites, staff, contractors and suppliers that handle information on behalf of the company.

Create this policy

What the policy contains

Principles
Commitments
Supporting rules

Who is responsible

Management
Information Security Manager
Asset and risk owners
All staff and contractors

What you decide

Approved by
Policy reviewQuarterly · Every 6 months · Yearly

References covered

ISO/IEC 27001 Annex A: control 5.1
ISO/IEC 27001 Annex A: control 5.2
ISO/IEC 27001 Annex A: control 5.4
ISO/IEC 27001 Annex A: control 5.36
GDPR: Art. 5 principles
GDPR: Art. 24 responsibility of the controller
GDPR: Art. 32 security of processing
NIS2: Art. 20 governance
NIS2: Art. 21(2)(a) policies on risk analysis and information system security

Other policy templates

Acceptable Use Policy
Access Control Policy
Password Policy
Bring Your Own Device (BYOD) Policy
Remote Work Policy
Business Continuity Policy