Consolidating policies
Assign topic to the user
Answer:
Although ISO 27001 allows merging documents, the ISMS Policy is a high level document (to be used for all organization), while the remaining policies you mentioned are considered operational policies (to be used by specific areas or processes), so in this case we advise not to integrate them in a single document, because this document would become unnecessarily big and difficult to read and manage.
These articles will provide you further explanation about developing policies:
- What should you write in your Information Security Policy according to ISO 27001? https://advisera.com/27001academy/blog/2016/05/30/what-should-you-write-in-your-information-security-policy-according-to-iso-27001/
- One Information Security Policy, or several policies? https://advisera.com/27001academy/blog/2013/06/18/one-information-security-policy-or-several-policies/
Comment as guest or Sign in
Jan 10, 2019