How to Write an Information Security Policy (ISO 27001, BSI)

Definition: The information security policy is the top-level security document of an organization. Senior management approves it. It sets out why security matters, which goals apply and who is responsible for what.

In German, this document is called IT-Sicherheitsleitlinie or Leitlinie zur Informationssicherheit. Many people also say "security policy" for the detailed rules on single topics. Strictly speaking, those are a different kind of document, as the next section shows.

Policy, topic policies and security concept: the difference

The documents in an ISMS build on each other. The top-level policy sits at the top. Below it come rules and plans that get more and more specific.

Top-level policy: a few pages, strategic and valid for years. It says why you do information security and what you want to achieve.
Topic-specific policies: binding rules for single topics. Examples are password, backup, mobile device or access control policies. They say what people must do.
Security concept: describes which controls address which risks in a given scope. See the entry on the IT security concept.
Work instructions: show step by step how to do a task.

The top-level policy rarely changes. Topic policies and concepts change more often, as systems and risks evolve.

What goes into an information security policy

A good policy is short and clear to every employee. These points almost always belong in it:

Scope: which sites, units, systems and people does the policy cover?
Importance: why does information security matter to your business? How much do you depend on IT?
Security objectives: which goals do you pursue? Most build on the core objectives of confidentiality, integrity and availability.
Roles and duties: what is the role of senior management? Who is the security officer or CISO? What do managers and staff have to do?
Requirements: which laws, contracts and standards must you meet?
Improvement: management commits to review and improve security on an ongoing basis.
Consequences: what happens if someone breaks the security rules?

At the end, add the date, the version and the signature of senior management.

The policy in ISO/IEC 27001

ISO/IEC 27001 covers the policy in clause 5.2 "Policy". Top management must establish it. The standard sets a few requirements:

It fits the purpose of the organization.
It includes security objectives or gives a framework for setting them.
It includes a commitment to meet the security requirements that apply.
It includes a commitment to keep improving the ISMS.

The policy must also be kept as documented information. It must be shared within the organization. And it must be available to interested parties, as appropriate. Without a policy, you cannot get ISO 27001 certified.

The policy in BSI IT-Grundschutz

The German BSI IT-Grundschutz also calls for a policy, the "Leitlinie zur Informationssicherheit". BSI Standard 200-1 describes it as part of the management system. BSI Standard 200-2 makes it one of the first steps in the security process. With it, management takes visible ownership of security.

Only then do you set up the security organization and write the security concept. So the policy sets the frame in which the concept is built.

NIS2: management is accountable

Article 20 of the NIS2 Directive says that management bodies must approve the risk management measures and oversee how they are put in place. In Germany, section 38 of the BSI Act (BSIG) implements this. Management must put the measures in place, oversee them and take part in regular training.

A policy signed by management is a good starting point for this. It shows that management has set goals and assigned roles. On its own, though, it is not enough proof.