Free template

Information Security Policy Template

A free, editable information security policy template aligned with ISO/IEC 27001:2022 clause 5.2 and Annex A 5.1, with purpose, scope, roles, principles, compliance and document control sections.

The information security policy is the top document in a security policy framework. It sets direction, shows leadership commitment and points to the topic-specific policies underneath it. ISO/IEC 27001 clause 5.2 requires one, approved by top management.

This template is deliberately short. Keep detailed rules in topic-specific policies and standards so this document only needs to change when the organisation's direction changes.

How to use this template

Replace every [bracketed] placeholder with your organisation's details.
Remove principles that do not apply and add any your risks or contracts require.
List the topic-specific policies you actually have in section 6.
Have top management approve it and record the approval in the document control table.
Publish it to all staff, collect acknowledgements and set a yearly review date.

The template

Markdown opens in any editor and pastes into Word, Google Docs or Notion.

# Information Security Policy

**Organisation:** [Organisation name]
**Version:** [1.0]  |  **Approved by:** [Name, role]  |  **Approval date:** [YYYY-MM-DD]
**Owner:** [Role, for example Head of GRC]  |  **Next review:** [YYYY-MM-DD]
**Classification:** Internal

## 1. Purpose
This policy sets out [Organisation name]'s commitment to protecting the confidentiality, integrity and availability of the information we hold and the systems we use, and to meeting our legal, regulatory and contractual obligations.

## 2. Scope
This policy applies to all employees, contractors, temporary staff and third parties who access [Organisation name] information or systems, wherever they work. It covers all information in any format and all systems, devices and services used to process it, including cloud and AI services.

## 3. Objectives
- Protect information from unauthorised access, disclosure, change and loss.
- Manage information security risk to within the risk appetite approved by leadership.
- Meet applicable laws and regulations, including [GDPR / other], and customer contracts.
- Detect, respond to and learn from security incidents quickly.
- Continually improve the information security management system.
Measurable objectives are set each year and tracked by [role].

## 4. Roles and responsibilities
- **Top management** approves this policy, sets risk appetite, provides resources and reviews performance at least [annually].
- **[Information Security Lead / Head of GRC]** owns the security program, maintains the policy framework and reports status to management.
- **Information and system owners** classify information, approve access and own the risks to their assets.
- **Managers** make sure their teams know and follow security policies and complete training.
- **All staff and contractors** follow this policy and related policies, protect the information they handle and report incidents and weaknesses immediately.

## 5. Principles
5.1 Information security risks are assessed using an approved method and treated according to the risk appetite.
5.2 Access to information is granted on a least-privilege, need-to-know basis and reviewed regularly.
5.3 Multi-factor authentication is used for remote access, email and systems holding sensitive data.
5.4 Information is classified and handled according to its classification.
5.5 Personal data is processed lawfully and protected in line with data protection law.
5.6 Suppliers that access our information or systems are assessed and bound by security requirements.
5.7 Security events and incidents are reported, assessed and handled under the incident response plan.
5.8 Critical information is backed up and recovery is tested.
5.9 Everyone receives security awareness training on joining and at least annually.
5.10 Security is considered from the start of every project, change and purchase.

## 6. Supporting policies
This policy is supported by topic-specific policies, including:
- [Acceptable Use Policy]
- [Access Control Policy]
- [Data Classification and Handling Policy]
- [Data Protection Policy]
- [Incident Response Policy]
- [Supplier Security Policy]
- [Backup and Business Continuity Policy]

## 7. Exceptions
Where a requirement cannot be met, an exception must be requested from [role], with the business reason, risk, compensating controls and an expiry date. Approved exceptions are recorded in the risk register.

## 8. Compliance
Compliance is monitored through control checks, internal audit and management review. Breaches of this policy may lead to disciplinary action in line with [HR policy].

## 9. Review
This policy is reviewed at least annually and after significant changes to the organisation, risks or legal requirements.

## Document control
| Version | Date | Author | Approved by | Summary of changes |
| --- | --- | --- | --- | --- |
| [1.0] | [YYYY-MM-DD] | [Name] | [Name] | First issue |

Frequently asked questions

Is an information security policy mandatory for ISO 27001?

Yes. Clause 5.2 requires an information security policy established by top management, and Annex A control 5.1 covers policies for information security, including topic-specific ones.

What should an information security policy include?

Purpose, scope, objectives, roles and responsibilities, core principles, the supporting policies, how exceptions work, how compliance is checked and when the policy is reviewed.

Templates are general starting points, not legal advice. Adapt them to your organisation and check legal requirements for your jurisdiction.