Key takeaways
- Write a top-level security policy plus topic policies, get management to approve them, and share them with staff.
- Policies set the rules every other control relies on.
- Start here: draft a short top-level information security policy that states your objectives and management's commitment.
Purpose
Write a top-level security policy plus topic policies, get management to approve them, and share them with staff.
Requirement
Requirement summaryInformation security policy and topic-specific policies shall be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur.
Why it matters
Policies set the rules every other control relies on. Without approved, communicated policies, staff have no baseline and auditors have nothing to test against.
How to implement
- Draft a short top-level information security policy that states your objectives and management's commitment.
- Write topic-specific policies (access, cryptography, backup, suppliers and so on) only where your risks call for them.
- Have top management formally approve each policy and record the approval date.
- Publish policies somewhere every employee can reach and collect acknowledgements at onboarding and after updates.
- Schedule an annual review and trigger extra reviews after major changes, incidents or audits.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.1. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your information security policy, signed off by senior management and dated.
- Your other security policies (for example access control, backup, acceptable use), each with an owner, version number and next review date.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.1 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Proof that staff have read and accepted the policies, such as sign-off records or acknowledgements.
- Evidence that each policy was reviewed on schedule, such as a review date and change notes.
- Where staff can find the policies, such as an intranet page or onboarding pack.
Things you should be able to show or explain
- Staff should be able to tell you where the policies live and name a few rules that apply to their job.
How much to show: A handful of policies and a handful of staff, including someone who joined recently.
Common mistakes
- Policies past their review date with nothing to show they were looked at.
- New starters who never signed the policies.
- Copying generic policies that describe processes you do not actually follow.
- No evidence of acknowledgement, so you cannot prove staff have read them.
- Tip: Keep policies short and review them yearly or after big changes.
Policies & documents to have
- Information Security Policy and topic-specific policies
FAQ
Is A.5.1 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.1?
Be ready to explain how the control works in your organisation and to provide things like: Your information security policy, signed off by senior management and dated…