ISO 27001 Implementation Guideline Clause 5.2 Policy
Required activity Top management establishes an information security policy. Explanation The information security policy describes the strategic importance of the ISMS for the organization and is out there as documented information . The policy directs information security activities within the organization.The policy states what the requirements for information security are within the actual context of the organization. The information security policy should contain brief, high level statements of intent and direction concerning information security. It is often specific to the scope of an ISMS or can have wider coverage. All other policies, procedures, activities and objectives associated with information security should be aligned to the knowledge security policy. The information security policy should reflect the organization’s business situation, culture, issues and concerns concerning information security. The extent of the knowledge secur...