ISO 27001 Information Security Policy Template (and the Common Policy Set)

Top-Level Information Security Policy (5.2)

Draft a short board-approved policy that states purpose, commitment to requirements, continual improvement, and how objectives are set. Publish it internally and make it available to interested parties as appropriate.

Common Policy Set (Examples — Not a Mandated Count)

• Access control / identity
• Acceptable use
• Cryptography / key management
• Asset management
• Secure development
• Change and configuration
• Logging and monitoring
• Incident management
• Business continuity / backup
• Supplier / third-party security
• Physical security
• HR security / acceptable remote work
• Privacy / data classification (where in scope)
• Vulnerability and patch management

Add or drop titles based on your SoA — SaaS firms often expand secure development and cloud; OT environments expand physical and safety-adjacent controls.

Frequently Asked Questions

Does ISO 27001 require exactly 20 policies?

No. Clause 5.2 requires an information security policy as documented information. Additional topic policies are chosen based on risk and Annex A needs (often guided by A.5.1).

What must the top-level policy include?

Clause 5.2 requires a policy appropriate to the purpose of the organization, including information security objectives (or a framework for them), commitment to satisfy applicable requirements, and commitment to continual improvement — available as documented information and communicated.

Are templates enough for certification?

Templates accelerate drafting. Auditors look for approved, communicated, implemented policies that match how the organization actually operates.

Related ISO 27001 Resources

Mandatory documents · SoA · Annex A.5