---
title: "Information security policy template"
canonical: https://www.grcmana.io/vault/templates/information-security-policy
published: 2023-11-29
updated: 2026-10-17
author: "Harry West"
framework: "ISO 27001"
type: "Policy"
---

# Information security policy template

## Key Takeaways

An information security policy is the top-level document in which leadership sets how the organisation protects information. ISO 27001 clause 5.2 requires one, and control A.5.1 requires it to be approved, communicated, acknowledged and reviewed. This template gives a UK firm of 25 to 250 staff an auditor-ready starting point in Word.

- **Required by** — ISO 27001:2022 clause 5.2 and control A.5.1
- **Approved by** — Top management
- **Review cycle** — At least annually, and after significant change
- **Format** — Word, 7 pages, with a policy management checklist

## What's in the template

One Word document, seven pages, version 1.2. It has four parts:

1. **The information security policy.** Your top-level policy, laid out the way an ISO 27001 auditor reads it: purpose and scope, management's commitment, how the policy sets your security objectives, roles and responsibilities, the topic-specific policies that sit beneath it, and how it's approved, communicated and reviewed.
2. **A getting-started guide.** It shows which parts to edit first and what to leave alone.
3. **Next steps.** These show where the policy fits in your wider ISMS, and what to write after it.
4. **A policy management checklist.** It covers approval, sign-off, communication and review dates, which are the records an auditor asks to see alongside the policy.

Every placeholder is marked in square brackets, so you replace the names and dates, adjust the scope, and it's ready for management approval.

## What is an information security policy?

An information security policy is the document in which your leadership states how the organisation protects information: what's in scope, who is responsible, and what everyone must do.

It doesn't hold every technical rule. Those live in topic-specific policies such as access control, acceptable use and backup.

The information security policy sets the direction they all follow.

It's usually the first document a certification auditor asks for and the first one a customer's security questionnaire requests. If it's missing, or reads like a generic download with another company's name still in it, that tells the reviewer to dig deeper.

### Which standards require one

| Standard | What it asks for |
| --- | --- |
| ISO 27001:2022, clause 5.2 | Top management must set an information security policy that suits the organisation's purpose, includes or frames its security objectives, and commits to meeting applicable requirements and to continual improvement. It must be documented, communicated internally and available to interested parties as appropriate. |
| ISO 27001:2022, control A.5.1 | The policy and the topic-specific policies must be defined, approved by management, published, communicated to and acknowledged by relevant staff, and reviewed at planned intervals or when something significant changes. |
| DORA (EU financial entities) | An information security policy is part of the ICT risk management framework. |
| Customer due diligence | Most enterprise security questionnaires ask for a copy, or for the date it was last approved. |

For the detail on each requirement, see the [ISO 27001 A.5.1 guide](https://www.grcmana.io/vault/iso-27001/annex-a-5-1-information-security-policy) and the [clause 5.2 guide](https://www.grcmana.io/vault/iso-27001/clause-5-2-policy).

## How to create your information security policy with this template

With the groundwork in place, this takes about half a day plus one management meeting. Without it, the policy is the wrong place to start, so check the groundwork first.

### Before you start

Your policy has to describe an organisation that's ready for it.

Check you have:

- **An ISMS scope statement.** The policy's scope must match it, and clause 4.3 is where it's set. No scope statement yet? Write that first: see our guide to [ISO 27001 Clause 4.3](https://www.grcmana.io/vault/iso-27001/clause-4-3-determining-the-scope-of-the-information-security-management-system).
- **A named owner, and an approver with authority.** The owner keeps the policy current. The approver must be top management: someone who directs and controls the organisation.
- **A view of your topic-specific policies.** Know which exist today and which you'll publish before the audit. The policy will name them.
- **A sense of your risks.** Your commitments and objectives should reflect what you're protecting against. Our [clause 6.1 guide](https://www.grcmana.io/vault/iso-27001/clause-6-1-actions-to-address-risks-and-opportunities) covers this.

If none of these exist yet, the job is bigger than one policy. That's the point where most firms bring in help.

### 1. Name the owner and the approver *(10 minutes)*

- **Do this:** put names against the owner, approver and reviewer roles.
- **The template:** has those roles laid out, so you're filling in names, not designing a governance model.
- **Watch for:** an approver below top management. A CTO who sits on the executive team counts. An IT manager outside it doesn't, however capable they are.

### 2. Set the scope *(30 to 60 minutes)*

Next, say which teams, locations, systems and services the policy covers, in words that match your ISMS scope statement.

The template gives you the structure and placeholders. The judgement is in where you draw the line.

> **Where most firms get stuck:** A scope that doesn't match the ISMS. "All information and systems" sounds safe but can't be audited, and a scope drawn narrow to keep awkward systems out invites the auditor to ask why. Customers read it too, to check their service is covered.

### 3. Make every statement true *(about an hour)*

- **Do this:** confirm the two commitments clause 5.2 requires (to meet applicable requirements and to improve continually), decide how objectives are set, then read every remaining line and ask: "Could we show an auditor this happens?"
- **The template:** has the clause 5.2 commitments written in, and every organisation-specific detail in [brackets], so nothing generic hides in the prose.
- **Watch for:** writing this year's objectives into the policy. It dates within twelve months. Say where objectives are set, such as the management review, and keep them in a register.

> **Where most firms get stuck:** Keeping statements because they sound right. A policy that promises a control you don't run hands the auditor a nonconformity. Delete it, or reword it to what you actually do.

### 4. Link your topic-specific policies *(20 minutes)*

Then list the policies that sit beneath this one, such as access control, acceptable use and backup, using their exact titles.

Only list what exists, or what will be published before the audit: an auditor will ask for each one by name, and a missing policy is an easy finding.

### 5. Approve, publish and record acknowledgement *(one management meeting, then 1 to 2 hours)*

- **Do this:** take it to top management for approval and set the next review date, no more than a year out. Then publish it where staff can find it and ask everyone in scope to confirm they've read it.
- **The template:** includes a policy management checklist for the approval, review date and communication records.
- **Watch for:** approval that exists only as an email or a typed name, and acknowledgement no one can evidence. Both are covered in [How to use it so it holds up at audit](#how-to-use-it-so-it-holds-up-at-audit).

### Do it yourself, or have us do it with you

|  | Do it yourself with the template | Do it with GRCMANA |
| --- | --- | --- |
| What you end up with | An approved information security policy | This policy plus the topic-specific policies an ISO 27001 auditor expects, tailored to your scope and risks, and consistent with each other |
| Your time | About half a day, plus approval | About half a day of our time, plus your approval. The difference? You save half a day. |
| Best if | Someone on your team has the time and is comfortable making the judgement calls above | Compliance landed on you alongside your day job, the audit date is fixed, or a deal is waiting on it |

Prefer the second column? [Talk to us about ISO 27001 readiness](https://www.grcmana.io/contact).

## What good looks like

Most information security policies pass a quick read. Fewer survive an auditor's. Here is the difference.

### Weak and strong, side by side

| Clause | Weak | Strong | Why the strong one passes |
| --- | --- | --- | --- |
| Scope | "This policy applies to all information and systems." | "This policy applies to all staff, contractors and systems involved in delivering \[service\] from \[locations\], as defined in our ISMS scope statement." | It can be checked against the ISMS scope. "All" can't be audited. |
| Commitment | "Management is committed to information security." | "The \[CEO\] commits to meeting applicable legal, regulatory and contractual requirements, including UK GDPR and our client contracts, and to continually improving the ISMS." | It names both commitments clause 5.2 requires. |
| Objectives | "We aim to protect the confidentiality, integrity and availability of information." | "Information security objectives are set each year at the management review, recorded in \[register\] and measured against \[measures\]." | Clause 5.2 needs objectives or a framework for setting them. A slogan is neither. |
| Roles | "Everyone is responsible for security." | "The \[COO\] owns this policy and the ISMS. Line managers make sure their teams complete annual training. All staff report incidents to \[channel\]." | Named roles can be sampled. "Everyone" can't. |
| Review | "This policy will be reviewed regularly." | "This policy is reviewed at least annually by \[owner\] and approved by \[CEO\]. Next review: \[date\]." | Control A.5.1 needs planned intervals. A date can be tested. |

### What an auditor checks in the first five minutes

Before reading the detail, most auditors check that:

- **It's current.** It has a version, an approval date and a review date that hasn't passed.
- **The right person approved it.** The approver is top management, and there's a record of the approval.
- **The scope matches.** It describes the same scope as the ISMS scope statement.
- **The commitments are there.** It covers objectives, meeting requirements and continual improvement.
- **It's genuinely yours.** It has your organisation's name and specifics throughout, with no leftover template text or another firm's name.
- **The named policies exist.** Every topic-specific policy it lists can be produced on request.

If all six hold, the auditor moves on with confidence. If one fails, they usually look harder at everything else.

### What good looks like at 25 staff and at 250

| Feature | Around 25 staff | Around 250 staff |
| --- | --- | --- |
| Length | Two to three pages | Three to five pages; the detail sits in topic-specific policies |
| Approver | The CEO or managing director | The board or executive committee |
| Owner | A director who holds it alongside their main role | A named security or compliance lead |
| Topic-specific policies | A handful, some combined (for example, acceptable use with remote working) | A full set, typically 15 or more |
| Objectives | Three to five, reviewed at the management review | Measured, with metrics reported to the management review |
| Acknowledgement | E-signature or a tracked email | An HR system or training platform |

The common mistake at 25 staff is adopting a policy written for 2,500: it promises processes the firm can't run. The common mistake at 250 is the reverse, a top-level policy that has never grown up with the firm.

## How to use it so it holds up at audit

The policy is only half the evidence. An auditor tests whether it operates, and these are the records they usually ask for:

- **The approval record:** who in top management approved this version, and when.
- **Acknowledgement:** evidence that staff in scope have read it, from an HR system, an e-signature or a training platform.
- **The review history:** the date of the last review, what changed, and the next review date.
- **Alignment:** the objectives and topic-specific policies it names actually exist, and are current.

**The most common reasons this policy fails audit:**

- It was never formally approved, or the approver isn't top management.
- It names policies, roles or tools that don't exist at the firm.
- No one can show that staff have seen it.
- It's more than a year old, and nothing shows it was reviewed.
- It was copied from a template and still carries the template's wording or another organisation's name.

Each of these is cheap to prevent and costly to explain in the audit room.

## Information security policy questions

### What should an information security policy include?

Its purpose and scope, leadership's commitment, how security objectives are set, who is responsible for what, the topic-specific policies that support it, and how it's approved, communicated and reviewed. ISO 27001 clause 5.2 also expects commitments to meet applicable requirements and to improve continually.

### How long should an information security policy be?

Short enough that staff will read it. For a firm of 25 to 250 people, two to five pages is typical. The detail belongs in topic-specific policies, not the top-level document.

### Who should approve the information security policy?

Top management, such as the CEO, managing director or board, not the IT lead who wrote it. ISO 27001 places this duty on top management, and auditors check who signed.

### How often should it be reviewed?

At planned intervals (annually is the norm) and after any significant change to the business, its services or its risks. Keep a record of each review, even when nothing changes.

### Is an information security policy the same as an ISMS?

No. The policy is one document. The ISMS is the whole management system it sits inside: scope, risk assessment, controls, internal audit, management review and improvement.

## Get the template

Start from a policy that already says what an auditor expects, written for a firm your size. Download the Word template, put your names in, and take it to your next management meeting for approval.

*This template is a starting point to adapt to your organisation, not legal advice.*