ISO 27001 Annex A 5.1Policies for information security
Official control statement
Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Have clear, approved security policies that everyone knows about and follows.
What this means in practice
This control is about having clear rules for protecting information in your organisation. If these rules, known as information security policies, aren't in place, your organisation could be at risk of data breaches, which can lead to financial loss, legal trouble, and damage to your reputation.
Framework
ISO/IEC 27001:2022
Control effect (Control Stack)
Preventative
ISO 27001 domain
Organisational controls
Classifications
N/A
Official last update
24 Oct 2022
Control Stack last updated
29 Sept 2026
Why it matters
If security policies are not defined, approved, communicated and acknowledged, staff lack clear direction, leading to unmanaged risk, inconsistent controls and higher breach likelihood.
Operational notes
Maintain an ISMS policy set: get management approval, publish and brief relevant personnel/parties, record acknowledgement, and review on a schedule and after major changes.
Implementation tips
- The board or top management should define an overall information security policy that fits the organisation's goals and priorities. They should consider laws like the Privacy Act 1988 and industry guidelines like the ASD Essential Eight when crafting these policies.
- Senior management should approve these information security policies to show their commitment. This involves reviewing the policies to ensure they cover necessary areas like data protection, access controls, and employee responsibilities.
- The IT manager should communicate these policies to all employees and relevant parties. This can be done through training sessions, emails, or an internal website, ensuring everyone acknowledges and understands their responsibilities.
- Department heads should develop topic-specific policies that address the unique needs of their areas, such as network security or data handling procedures. These specific guidelines ensure daily practices align with the overall security policy.
- Human Resources should regularly review these policies, especially when there's a significant change in business operations or technology. They should also organise regular policy review meetings to adjust and improve these policies as needed.
Audit / evidence tips
- AskThe information security policy documentLook atWhether it is formally approved by top managementGoodDocument will have signatures or notes from management showing their approval
- AskRecords of policy communication to staff and stakeholdersLook atThe methods used for communication and acknowledgment. Good evidence would include training logs or signed acknowledgments from employees
- AskThe latest policy review date and notesLook atWhether significant changes in the organisation triggered a reviewGoodIncludes a regular review schedule and evidence of adjustments made after incidents or changes
- AskExamples of topic-specific policies (e.g., data access policies)Look atHow these policies align with the main security policyGoodMatch shows particular policies supporting and conforming to the main policy's principles
- AskChange approval records for these policiesLook atThe approval process for any policy updatesGoodProcess includes a documented set of updates authorised by the responsible management
Cross-framework mappings
How Annex A 5.1 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 42001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(3)expand_less | ||
| Annex A 2.2 | Annex A 2.2 requires a documented policy governing AI system development or use | |
| Annex A 2.3 | Annex A 2.3 requires the organisation to determine where other organisational policies are affected by, or apply to, the organisation's o... | |
| Annex A 2.4 | Annex A 2.4 requires the organisation to review its AI policy at planned intervals and as needed to ensure it is suitable, adequate, and ... | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
open_in_fullBroader than(11)expand_less | ||
| ISM-0588 | ISM-0588 requires a specific topic policy for the use of multifunction devices to be developed, implemented and maintained | |
| ISM-1078 | ISM-1078 requires a specific topic policy for telephone system usage to be developed, implemented, and maintained | |
| ISM-1359 | ISM-1359 requires an organisation to develop, implement and maintain a topic-specific policy covering removable media usage | |
| ISM-1510 | Annex A 5.1 requires an organisation to establish and manage various security policies | |
| ISM-1549 | ISM-1549 requires an organisation to develop, implement, and maintain a media management policy for how media is handled and controlled | |
| ISM-1551 | ISM-1551 requires an organisation to develop, implement and maintain a specific topic policy for IT equipment management | |
| ISM-1864 | ISM-1864 requires a specific topic-level policy for system usage to be developed, implemented, and maintained | |
| ISM-1865 | ISM-1865 requires personnel to agree to abide by system usage policies before being granted access to systems and resources | |
| ISM-2074 | Annex A 5.1 requires organisations to establish and maintain information security policy and topic-specific policies, including communica... | |
| ISM-2105 | ISM-2105 requires a specific piece of personnel guidance about not posting work-duty information on unauthorised services and reporting o... | |
| ISM-2120 | ISM-2120 requires the organisation to develop, implement, and maintain a secure software development policy | |
sync_altPartially overlaps(9)expand_less | ||
| ISM-0039 | Annex A 5.1 requires the definition and management of information security policies | |
| ISM-0043 | Annex A 5.1 requires topic-specific policies to be defined, approved, communicated and reviewed, including for areas like incident manage... | |
| ISM-0047 | Annex A 5.1 requires defining, approving by management, publishing, communicating, acknowledging, and reviewing information security and ... | |
| ISM-0264 | Annex A 5.1 requires topic-specific policies to be defined, approved, communicated and reviewed to govern secure behaviour | |
| ISM-0888 | Annex A 5.1 mandates regular review of policies and their acknowledgment alongside management approval | |
| ISM-1478 | ISM-1478 requires the CISO to oversee the cyber security program and ensure compliance with cyber security policy, standards, regulations... | |
| ISM-1602 | ISM-1602 requires cyber security documentation (and subsequent changes) to be communicated to all stakeholders | |
| ISM-1617 | ISM-1617 calls for the CISO to regularly review and update the cyber security program to ensure its relevance | |
| ISM-1999 | ISM-1999 requires the board or executive committee to ensure the organisation's cyber security strategy aligns with the overarching strat... | |
extensionDepends on(1)expand_less | ||
| ISM-0407 | ISM-0407 requires keeping user access records including a signed agreement to abide by system usage policies and details of who authorise... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ISO 27001 controls in Organisational controls
See all Organisational controls controls, or browse the full ISO 27001 Annex A library. You can also track all 93 controls with the free ISO 27001 Annex A checklist.
Want to implement this control?
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.