Guest user Created: May 14, 2016 Last commented: May 14, 2016

What to include in Information security policy?

I am trying to compile my Information Security Policy and the above subject/areas are not as clear cut as I would like. Do you have to include both your products and the services of your organisation and is there a simple definition for them both to ensure I put the right details under each heading? Secondly if I include the like of Partnerships, Supply Chains and Relationships with interested parties do these then need to have a service level agreement to ensure they are providing us of what we need and they are compiling to our ways of working especially in relation to security.

0 0

Assign topic to the user

Select user

Expert

Dejan Kosutic May 14, 2016

Answer:

ISO 27001 does not require you to include product and services, nor partnerships, supply chains and interested parties in your Information security policy. According to ISO 27001, this policy is a top-level document without many details - see this article: Information security policy – how detailed should it be? https://advisera.com/27001academy/blog/2010/05/26/information-security-policy-how-detailed-should-it-be/

Typically, you should include info rmation about your products and services in your ISMS Scope document, see this article: How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/

And the information about interested parties and their requirements should go to a separate list, learn about it here: How to identify interested parties according to ISO 27001 and ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-identify-interested-parties-according-to-iso-27001-and-iso-22301//

You could include all this information in the Information security policy, but this would be very impractical.

This free online course will also be of great help to you: ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/

Quote

0 0

Comment as guest or Sign in

HTML tags are not allowed

Name *

Email *

I accept the Privacy and Terms

Notify me when someone replies

May 14, 2016

Expert Advice Community