Information Security Management Policy

What is an Information Security Management Policy?

Create the foundation of an Information Security Management System by detailing the objectives of information security within a policy that outlines the principles, processes and controls that your Company will maintain. 

Whether large or small, this high-level policy is key since it is primarily aimed at ensuring senior management agrees with and maintains control over information security practices and that they are aligned with the Company’s strategic objectives. 

Why is an Information Security Management Policy important?

Implementing this high-level policy allows SME’s to add more detailed policies for selected areas of information security (InfoSec) which become applicable over time. It is unlikely that you will need all 20+ InfoSec policies when you first launch but as you grow and risks change you can expand the scope of your InfoSec program.

Delivering shorter, more specific policies to those who need them means they are more likely to be followed and therefore achieve their goal of reducing risks. Traditional all-encompassing 60 page InfoSec policies are difficult to digest and keep up to date.

ISO 27001 Information Security Management Policy

InfoSec policies are part of the requirements of the ISO 27001 Certification standard. The Information Security Management policy is one of those ISO 27001 policies required, you can take a look at the full list here