Sections to include
- Purpose and the organisation's security objectives
- Scope: which entities, systems, people, and data are covered
- Legal, regulatory, and contractual obligations
Information Security Policy Template
The information security policy is the parent document auditors ask for first. Its job is not to contain every control. It is to state the organisation's position, assign responsibility, and point to the specific policies that implement it.
What you get
- A top-level policy structure that frameworks expect to see
- A responsibilities section naming roles rather than describing them vaguely
- A policy register covering the whole set, with owners and review dates
- An exception process, so deviations are recorded rather than silent
How to use this template
- 1
Keep the parent policy short. This document states position and assigns ownership. Controls belong in the specific policies beneath it. A fifty-page parent policy is one nobody reads and that needs rewriting whenever any detail changes.
- 2
Assign responsibilities to roles. Name the role accountable for each domain: access control, incident response, business continuity. Policies that say 'IT is responsible' leave nobody accountable in practice.
- 3
Maintain the policy register as the real deliverable. Auditors test whether policies are current, approved, and reviewed. The register showing version, owner, approval date, and next review answers that in one page.
What's inside
Here's a preview. Unlock the free download to get all 4 sections (3 more below).
Related templates
More free templates IT teams use alongside this one.
IT Policies
Get templateAcceptable Use Policy Template
An acceptable use policy only does its job if you can prove someone agreed to it. This one pairs clear, enforceable clauses with the acknowledgment register that turns the policy into something you can actually rely on in a disciplinary or legal process.
IT Policies
Get templateAccess Control Policy Template
Access control policies state least privilege and then leave the mechanics unspecified, which is where it breaks down. This one fixes the approval route, the review cadence, and the privileged-access rules explicitly.
Compliance & Audit
Get templateSOC 2 Evidence Tracker
A SOC 2 Type II does not test whether you have a control. It tests whether the control operated throughout the period, and asks you to prove it with artefacts from specific dates. This tracker is organised around that reality: per control, per evidence artefact, per sample date.
Frequently asked questions
What should an information security policy contain?
+
Purpose and objectives, scope, legal and contractual obligations, the classification scheme, roles and responsibilities by name of role, the risk approach and acceptance authority, references to subordinate policies, an exception process, and the review cycle.
How is an information security policy different from a security standard?
+
The policy states position and assigns accountability; it changes rarely. Standards and procedures specify how controls are implemented and change often. Mixing them produces a document that needs board re-approval every time a technical detail moves.
How many security policies does an organisation need?
+
Enough to cover the control domains you are assessed against, and no more. Most small and mid-sized organisations manage with eight to fifteen. What matters to an auditor is that each is owned, current, and demonstrably reviewed.