Glossary · Foundations
Security Policy
A high-level document approved by top management that states an organisation's intentions and direction for protecting information.
Put the term into practice: Risk management software
An information security policy is the anchor document of an ISMS. It sets out objectives, assigns responsibilities, and signals leadership commitment. ISO/IEC 27001 requires top management to establish and communicate such a policy.
The top-level policy is usually supported by topic-specific policies, for example on access control, acceptable use, or cryptography, and by procedures that describe how the rules are carried out day to day.
