Security Policy

Applies to. Requirement 12.1 is where the policy lives. 12.1.1 requires an overall information security policy that is established, published, maintained and disseminated to relevant personnel, vendors and business partners; 12.1.2 requires it to be reviewed at least once every 12 months and updated as business objectives or risks change; 12.1.3 requires it to define information security roles and responsibilities that personnel acknowledge; and 12.1.4 requires responsibility for information security to be formally assigned to a CISO or another security-knowledgeable executive. The security awareness programme then makes personnel aware of the policy (12.6.1) and has them acknowledge at least once every 12 months that they have read and understood it (12.6.3).

Limits. The standard tests one overall policy plus the procedures each requirement calls for; it does not prescribe a structure, template or length.