Information Security Policy

Inside the document

1. Governance and direction
2. Risk-based control selection
3. Information and asset management
4. People
5. Technical and operational security
6. Physical and environmental security
7. Suppliers, incidents and continuity
8. Legal, regulatory and contractual compliance

Plus document control, roles, exceptions, enforcement, review cycle and an auditor evidence checklist.

Sample clause · Risk-based control selectionControls shall be proportionate to risk and recorded in a [statement of applicability or control register], with a written reason for each control considered and not applied.

What an auditor will check

Approved and dated by top management, communicated to staff, reviewed on schedule, and backed by evidence that the framework actually runs.