ISO/IEC 27002's overall and topic-specific information security policies 0/11

Clause 5.1 of the forthcoming new edition of ISO/IEC 27002 recommends two complementary types of information security policies.

Firstly: 

At the highest level, organizations should define an “information security policy” which is approved by top management and which sets out the organization’s approach to managing its information security.

The policy (singular) should address requirements derived from various sources, and include a bunch of general policy statements, for example laying out the organisation's commitments (as stated by senior management) to satisfy applicable requirements relating to information security, and to improve the information security management system continually. 

In addition:

At a lower level, the information security policy should be supported by topic-specific policies, as needed to further mandate the implementation of information security controls. Topic-specific policies are typically structured to address the needs of certain target groups within an organization or to cover certain security areas. Topic-specific policies should be aligned and complementary to the information security policy of the organization.

Topic-specific policies (plural) should be aligned with and support the high-level policy, providing additional details in various areas. The standard lists 11 topics as examples ... and I plan to talk about those day by day through this blog. 

After that, I'll write about integrating all the policies, including the top one, into a coherent and comprehensive policy suite - taking an holistic/system view of the entire policy structure. 

So, tune in tomorrow for the first of twelve enthralling episodes!