Glossary term
Information Security Policy
Subject: Technology, Cyber and Data, Information Security Frameworks
Also known as: InfoSec policy, Security policy
An information security policy is the management-approved document that states how an organisation protects its information and systems, who is responsible, and the rules every employee and supplier must follow.
Explanation
This is the top document in an organisation's security rulebook. It is short and written in plain terms: what the organisation is protecting, why, who owns security decisions, and what staff may and may not do. Detailed standards and procedures sit beneath it, covering topics such as passwords, remote working, backups and supplier access. Senior management or the board approves it, which gives every lower document its authority. Standards such as ISO/IEC 27001 expect one to exist, and auditors usually start their review there. A policy is only useful if people know it and it is reviewed on a set cycle or after a major incident. A policy that nobody has read, or that describes controls the firm does not run, is a common audit finding. Without one, security choices stay scattered across teams and nobody can say who decided a given rule.
Example
A regional insurer is preparing for a certification audit. The auditor asks for the information security policy and finds a version approved four years ago that still refers to a data centre the insurer closed. The board security committee rewrites it, adds cloud use and remote work, and sets an annual review date.
Not to be confused with
- Information security standard
- The policy states intent and responsibility. Standards and procedures set the detailed, measurable settings and steps that carry it out.