ISO 27001 Annex A 5.1 Policies for information security
What it says
Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishHave clear, approved security policies that everyone knows about and follows.
This control is about having clear rules for protecting information in your organisation. If these rules, known as information security policies, aren't in place, your organisation could be at risk of data breaches, which can lead to financial loss, legal trouble, and damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
If security policies are not defined, approved, communicated and acknowledged, staff lack clear direction, leading to unmanaged risk, inconsistent controls and higher breach likelihood.
How to implement
The board or top management should define an overall information security policy that fits the organisation's goals and priorities.
They should consider laws like the Privacy Act 1988 and industry guidelines like the ASD Essential Eight when crafting these policies.
Senior management should approve these information security policies to show their commitment.
This involves reviewing the policies to ensure they cover necessary areas like data protection, access controls, and employee responsibilities.
The IT manager should communicate these policies to all employees and relevant parties.
This can be done through training sessions, emails, or an internal website, ensuring everyone acknowledges and understands their responsibilities.
Department heads should develop topic-specific policies that address the unique needs of their areas, such as network security or data handling procedures.
These specific guidelines ensure daily practices align with the overall security policy.
Human Resources should regularly review these policies, especially when there's a significant change in business operations or technology.
They should also organise regular policy review meetings to adjust and improve these policies as needed.
Keep it running
Maintain an ISMS policy set: get management approval, publish and brief relevant personnel/parties, record acknowledgement, and review on a schedule and after major changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The information security policy document.
Look at
Whether it is formally approved by top management.
Good evidence
Document will have signatures or notes from management showing their approval.
- Check 2 of 5What an auditor asks for
Ask for
Records of policy communication to staff and stakeholders.
Look at
The methods used for communication and acknowledgment. Good evidence would include training logs or signed acknowledgments from employees.
- Check 3 of 5What an auditor asks for
Ask for
The latest policy review date and notes.
Look at
Whether significant changes in the organisation triggered a review.
Good evidence
Includes a regular review schedule and evidence of adjustments made after incidents or changes.
- Check 4 of 5What an auditor asks for
Ask for
Examples of topic-specific policies (e.g., data access policies).
Look at
How these policies align with the main security policy.
Good evidence
Match shows particular policies supporting and conforming to the main policy's principles.
- Check 5 of 5What an auditor asks for
Ask for
Change approval records for these policies.
Look at
The approval process for any policy updates.
Good evidence
Process includes a documented set of updates authorised by the responsible management.
Mappings
Closest match in ASD Information Security Manual: ISM-0588, Develop and maintain MFD usage policy, which this control covers in full and more.
ISO/IEC 42001: 3 mappings
This control partially overlaps A.2.2.
Annex A 2.2 requires a documented policy governing AI system development or use. Annex A 5.1 supports this by setting the organisational expectations for policies to be defined, management-approved, published, communicated, acknowledged, and reviewed-attributes that an AI policy created under Annex A 2.2 would typically need to meet. Annex A 5.1 is information-security-policy governance generally and does not itself establish AI-specific policy content or scope.
This control partially overlaps A.2.3.
Annex A 2.3 requires the organisation to determine where other organisational policies are affected by, or apply to, the organisation's objectives for AI systems. Annex A 5.1 requires defining, approving, communicating and periodically reviewing information security policies. They overlap because Annex A 2.3 will often drive updates to, and consistency checks against, information security policy sets governed under Annex A 5.1, but Annex A 5.1 is specifically about information security policy lifecycle rather than cross-policy AI alignment.
This control partially overlaps A.2.4.
Annex A 2.4 requires the organisation to review its AI policy at planned intervals and as needed to ensure it is suitable, adequate, and effective. ISO/IEC 27001:2022 Annex A 5.1 similarly requires information security policies to be reviewed at planned intervals and upon significant changes, though it also includes requirements for policy definition, approval, and communication.
ASD Information Security Manual: 21 mappings
This control is broader than ISM-0588.
ISM-0588 requires a specific topic policy for the use of multifunction devices to be developed, implemented and maintained. Annex A 5.1 requires information security and topic-specific policies to be defined, approved, communicated, acknowledged and reviewed at planned intervals. ISM-0588 fits as one example of a topic-specific policy under Annex A 5.1, but Annex A 5.1 is broader in governance and lifecycle requirements for all policies.
This control is broader than ISM-1078.
ISM-1078 requires a specific topic policy for telephone system usage to be developed, implemented, and maintained. ISO/IEC 27001:2022 Annex A 5.1 establishes the overarching requirement to define, approve, communicate, acknowledge, and periodically review information security policies and topic-specific policies. ISM-1078 fits within Annex A 5.1 as one such topic-specific policy, but does not itself cover the full governance lifecycle elements (e.g., acknowledgement and scheduled review) to the same explicit extent.
This control is broader than ISM-1359.
ISM-1359 requires an organisation to develop, implement and maintain a topic-specific policy covering removable media usage. Annex A 5.1 requires the organisation to define, approve, publish, communicate, acknowledge and periodically review information security policy and topic-specific policies. Annex A 5.1 sets the overarching policy governance lifecycle that a removable media policy under ISM-1359 would sit within.
This control is broader than ISM-1510.
Annex A 5.1 requires an organisation to establish and manage various security policies. ISM-1510 focuses on a digital preservation policy, which would be under the broader suite of policies governed by Annex A 5.1. Annex A 5.1 encompasses lifecycle activities across all policies, while ISM-1510 targets a specific policy area.
This control is broader than ISM-1549.
ISM-1549 requires an organisation to develop, implement, and maintain a media management policy for how media is handled and controlled. Annex A 5.1 requires information security policies (including topic-specific policies) to be defined, approved, communicated, and reviewed, which would include a media management policy as one such topic. Annex A 5.1 is broader because it sets governance expectations for the whole policy framework, while ISM-1549 is specific to the media management policy topic.
This control is broader than ISM-1551.
ISM-1551 requires an organisation to develop, implement and maintain a specific topic policy for IT equipment management. Annex A 5.1 requires the organisation to define, approve, publish, communicate, acknowledge and review information security policy and topic-specific policies, providing overarching governance for how such policies are managed. ISM-1551 is a specific instance of the topic-specific policy concept in Annex A 5.1, focused on equipment management content rather than enterprise policy governance.
This control is broader than ISM-1864.
ISM-1864 requires a specific topic-level policy for system usage to be developed, implemented, and maintained. Annex A 5.1 is broader, requiring an overarching information security policy framework and topic-specific policies to be defined, approved, communicated, acknowledged, and reviewed. ISM-1864 fits as one such topic-specific policy within the wider governance requirements of Annex A 5.1.
This control is broader than ISM-1865.
ISM-1865 requires personnel to agree to abide by system usage policies before being granted access to systems and resources. Annex A 5.1 requires information security and topic-specific policies to be published, communicated and acknowledged by relevant personnel, which directly underpins obtaining user acknowledgement/acceptance as part of access onboarding. Annex A 5.1 is broader (policy lifecycle and communication), while ISM-1865 is a specific access-gating requirement focused on agreement prior to access.
This control is broader than ISM-2074.
Annex A 5.1 requires organisations to establish and maintain information security policy and topic-specific policies, including communication and periodic review. ISM-2074 is a topic-specific requirement to develop an AI usage policy for systems access, which is one example of the topic-specific policies envisioned by Annex A 5.1. Annex A 5.1 is broader because it covers the full policy framework and lifecycle across all topics, not just AI usage.
This control is broader than ISM-2105.
ISM-2105 requires a specific piece of personnel guidance about not posting work-duty information on unauthorised services and reporting occurrences. ISO/IEC 27001:2022 Annex A 5.1 requires information security policies (including topic-specific policies) to be defined, communicated and acknowledged. ISM-2105 is a concrete topic-specific policy message that would typically sit under and be communicated via the broader policy framework required by Annex A 5.1.
This control is broader than ISM-2120.
ISM-2120 requires the organisation to develop, implement, and maintain a secure software development policy. ISO/IEC 27001:2022 Annex A 5.1 requires the organisation to establish, approve, communicate, acknowledge, and review the full set of information security policies, including topic-specific policies. ISM-2120 is therefore a concrete instance of the broader policy governance requirements in Annex A 5.1, focused specifically on secure software development.
This control partially overlaps ISM-0039.
Annex A 5.1 requires the definition and management of information security policies. ISM-0039 requires a cyber security strategy, which overlaps by providing guidance that can influence policy priorities. Yet, a strategy does not equate to the policy controls (approval, communication, acknowledgement) that Annex A 5.1 mandates.
This control partially overlaps ISM-0043.
Annex A 5.1 requires topic-specific policies to be defined, approved, communicated and reviewed, including for areas like incident management. ISM-0043 overlaps by mandating a cyber security incident response plan with defined reporting, responsibilities, evidence integrity, and contingency measures, which is typically a topic-specific policy/plan governed under Annex A 5.1. ISM-0043 goes deeper into incident response content, while Annex A 5.1 is broader and focuses on policy governance and lifecycle rather than the plan's detailed operational requirements.
This control partially overlaps ISM-0047.
Annex A 5.1 requires defining, approving by management, publishing, communicating, acknowledging, and reviewing information security and topic-specific policies. ISM-0047 relates by prescribing who must approve organisational-level and system-specific cyber security documentation, aligning with the approval-by-management element. However, ISM-0047 focuses on approval authority and does not cover policy publication, communication/acknowledgement, or review cadence required by Annex A 5.1.
This control partially overlaps ISM-0264.
Annex A 5.1 requires topic-specific policies to be defined, approved, communicated and reviewed to govern secure behaviour. ISM-0264 overlaps by requiring an email usage policy to be developed, implemented and maintained, which is a direct example of a topic-specific policy covered by Annex A 5.1. ISM-0264 is narrower (email usage only) and does not explicitly include the full policy governance lifecycle elements (acknowledgement, planned reviews, change-triggered reviews) required by Annex A 5.1.
This control partially overlaps ISM-0888.
Annex A 5.1 mandates regular review of policies and their acknowledgment alongside management approval. ISM-0888 requires cyber security documentation to be reviewed annually and marked with a currency date, aligning with review timing requirements in Annex A 5.1. However, ISM-0888 is narrower as it does not cover initial policy definition, management approval, publication, or staff communication/acknowledgement.
This control partially overlaps ISM-1478.
ISM-1478 requires the CISO to oversee the cyber security program and ensure compliance with cyber security policy, standards, regulations and legislation. Annex A 5.1 relates by requiring information security policies to be defined, management-approved, communicated, acknowledged and reviewed, which are key artefacts and processes used to drive and evidence compliance. ISM-1478 is broader in encompassing compliance to external obligations and overall program oversight, while Annex A 5.1 is focused on the lifecycle and governance of policy documentation and communication.
This control partially overlaps ISM-1602.
ISM-1602 requires cyber security documentation (and subsequent changes) to be communicated to all stakeholders. ISO/IEC 27001:2022 Annex A 5.1 similarly requires information security policies to be published/communicated (and reviewed when significant changes occur), aligning strongly with communicating policy documents and updates. However, ISM-1602 is broader in that it applies to cyber security documentation generally (not just policies) and explicitly emphasises notification of changes to all stakeholders.
This control partially overlaps ISM-1617.
ISM-1617 calls for the CISO to regularly review and update the cyber security program to ensure its relevance. ISO/IEC 27001:2022 Annex A 5.1 overlaps by requiring periodic reviews of information security policies, including specific ones. While ISM-1617 covers the entire security program, Annex A 5.1 focuses on policy review, a critical component of program governance and renewal.
This control partially overlaps ISM-1999.
ISM-1999 requires the board or executive committee to ensure the organisation's cyber security strategy aligns with the overarching strategic direction and business strategy. Annex A 5.1 requires information security policies to be defined, approved by management, communicated, acknowledged, and reviewed. They overlap because aligned strategy (ISM-1999) typically drives the security policy framework (Annex A 5.1) and ensures policies support business objectives. However, Annex A 5.1 is focused on the policy lifecycle and communication, while ISM-1999 is governance-level alignment rather than policy mechanics.
This control depends on ISM-0407.
ISM-0407 requires keeping user access records including a signed agreement to abide by system usage policies and details of who authorised access. Annex A 5.1 requires information security policies to be communicated and acknowledged, and ISM-0407's signed agreement record is a concrete mechanism to evidence that acknowledgement. Annex A 5.1 is broader policy governance, while ISM-0407 is operational recordkeeping for user access.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.
Draft your ISO 27001 documentation