Information Security Policy
What is Information Security Policy?
A formal document that defines an organisation's approach to managing and protecting its information assets. The policy sets the strategic direction for information security and is typically approved by top management.
Terms that appear alongside information security policy
Each of these is named in at least one of the same controls as information security policy. The number is how many controls name both.
- policy 34 shared controls
- policy framework 10 shared controls
- security policy framework 10 shared controls
- roles and responsibilities 4 shared controls
- ciso 4 shared controls
- governance 4 shared controls
- compliance 4 shared controls
- encryption 3 shared controls
Frameworks that govern information security policy
What the standards actually require on information security policy
Requirements naming information security policy across 6 standards, quoted from the control text.
Agencies must have an Information Security Policy (SecPol). The source notes that the Chief Executive usually sponsors the SecPol and the CISO or the Chief Information Officer (CIO) usually manages it.
new-zealand-information-security-manual-nzism::5.1.7.C.01 · 5.1.7.C.01 Agency information security policy (SecPol) in place →Cloud service customer: include the cloud service provider as a type of supplier in its information security policy for supplier relationships, which helps mitigate the risks associated with the provider's access to and management of customer data.
iso-27017-2015::15.1.1 · Information security policy for supplier relationships →The processor has a written information security policy covering personal information it processes on behalf of a controller.
global-cross-border-privacy-rules-global-cbpr-forum::PRP.1 · Global PRP requirement 1: information security policy covering personal information processed for controllers →Information security requirements for reducing the risks that arise when suppliers can reach the organization's assets are agreed with the supplier and written down.
iso-27001-2013::A.15.1.1 · Information security policy for supplier relationships →Management with suitable authority approves an information security policy relevant to the organization. The policy is documented, takes account of the service requirements and the obligations recorded under 6.3 c), and is made available as appropriate.
iso-iec-20000-1-2018::8.7.3.1 · 8.7.3.1 Information security policy →Review of the information security policy: at every level the policy is reviewed at least once a year (the MTCS fixes the annual interval that ISO/IEC 27001 leaves to the organisation) and when significant changes occur, with the review recorded.
mtcs-singapore::6.6 · Review of information security policy →Questions people ask about information security policy
What is Information Security Policy?
Why is Information Security Policy important for compliance?
Which compliance frameworks address Information Security Policy?
Where can I learn more about Information Security Policy?
See how Information Security Policy applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.