ISO 27001:2022 required policies: the mandatory one and the topic-specific policies
ISO/IEC 27001:2022 explicitly requires only one policy in its clauses: the information security policy (clause 5.2), approved by top management, documented and communicated. Annex A control 5.1 adds topic-specific policies (access control, backup, cryptography, suppliers, remote working and so on), which are required only if your Statement of Applicability marks the related control as applicable. In practice, a mid-sized company ends up with the overarching policy plus 10 to 20 topic-specific policies, depending on its risks.
The mandatory policy: clause 5.2
Clause 5.2 asks top management to establish an information security policy that fits the purpose of the organization, includes information security objectives (or a framework for setting them) and states two commitments: to satisfy applicable requirements and to continually improve the ISMS.
- It must be available as documented information.
- It must be communicated within the organization.
- It must be available to interested parties as appropriate (customers, suppliers, auditors).
- Keep it short (2 to 4 pages) and point to the topic-specific policies for the details.
A common mistake is a 30-page overarching policy full of technical rules: it is hard to approve, nobody reads it, and every change has to go back to management.
Topic-specific policies: Annex A control 5.1
Control 5.1 asks you to define the information security policy and topic-specific policies, have them approved by management, publish them, communicate them to relevant people (who acknowledge them) and review them at planned intervals or when significant changes occur. The ISO/IEC 27002:2022 guidance gives examples of topics such as access control, physical security, asset management, information transfer, user endpoint devices, network security, incident management, backup, cryptography, information classification, technical vulnerabilities and secure development.
The standard does not set a closed list or a format: you can write one policy per topic, group several topics in one document or put the rules in procedures. What the auditor checks is that every applicable control has rules that are defined, approved, communicated and current.
ISO 27001 ISMS documentation toolkit
84 Word and Excel templates to document your ISMS based on ISO/IEC 27001:2022.
See the full toolkitList of topic-specific policies and the controls they cover
| Policy | Annex A controls | When do you need it? |
|---|---|---|
| Information security policy (overarching) | Clause 5.2 and 5.1 | Always. |
| Acceptable use of assets | 5.10 | Almost always: everyone uses devices and data. |
| Inventory and management of assets | 5.9, 5.11 | Whenever you have information assets (that is, always). |
| Information classification and labeling | 5.12, 5.13 | If you handle information of different sensitivity. |
| Access control and identity management | 5.15 to 5.18, 8.2 to 8.5 | Always. |
| Supplier security | 5.19 to 5.22 | If third parties access your information or systems. |
| Use of cloud services | 5.23 | If you use cloud email, storage or systems. |
| Information security incident management | 5.24 to 5.28, 6.8 | Always. |
| Business continuity and ICT readiness | 5.29, 5.30 | Almost always. |
| Legal compliance and personal data protection | 5.31 to 5.34 | Whenever you process personal data. |
| Human resources security | 6.1 to 6.6 | Whenever you have staff. |
| Remote working | 6.7 | If there is remote or hybrid work. |
| Clear desk and clear screen | 7.7 | If you have offices or shared spaces. |
| Storage media and secure disposal | 7.10, 7.14, 8.10 | If you use disks or USB drives, or retire equipment. |
| User endpoint devices | 8.1 | If staff use laptops or phones with company data. |
| Protection against malware | 8.7 | Always. |
| Management of technical vulnerabilities | 8.8 | Whenever you run or manage systems. |
| Information backup | 8.13 | Always. |
| Logging and monitoring | 8.15, 8.16 | If you manage servers, cloud or applications. |
| Cryptography | 8.24 | If you encrypt data or communications (almost always). |
| Change management and secure development | 8.25 to 8.29, 8.32 | If you develop software or change production systems. |
| Physical and environmental security | 7.1 to 7.13 | If you have offices, a server room or your own equipment. |
| Network and operations security | 8.20 to 8.22 | If you manage your own networks. |
This is the structure of our ISO 27001 toolkit: 1 overarching policy and 22 topic-specific policies, each citing its controls by number. The "when do you need it?" column is a guide only: the final decision comes from your risk assessment and Statement of Applicability.
How to decide which policies your company needs
- Start from the risk assessment (6.1.2) and the Statement of Applicability (6.1.3): every applicable control needs written rules somewhere.
- Group topics in a small company: remote working, endpoint devices and clear desk can go into a single workplace policy.
- Do not write policies for excluded controls: if you do not develop software, justify excluding 8.25 to 8.28 in the SoA instead of inventing a policy nobody follows.
- Write down what you actually do: the auditor compares the policy with practice and with records.
- Give every policy an owner, a review date and a version.
What the auditor checks in your policies
- Management approval (signature, minutes or approval record) and the current version.
- Evidence of communication: email, intranet, onboarding or staff acknowledgement.
- Review at planned intervals: date of the last review and recorded changes.
- Consistency with the Statement of Applicability: no applicable controls without rules and no policies for excluded controls.
- Practice matching the text: if the policy says daily backups tested every quarter, there must be records of those tests.
Next step
Try it free or go straight to the complete solution.
ISO 27001 ISMS documentation toolkit
84 Word and Excel templates to document your ISMS based on ISO/IEC 27001:2022.
See the full toolkit
Free sample
Download a reduced version of the toolkit's risk matrix for free (Excel, 10 scenarios, heat map). See how it calculates risk level and category before you decide.
Get the free sampleFrequently asked questions
How many policies does ISO 27001 require?
Only one is explicitly required in the clauses: the information security policy (5.2). Topic-specific policies under control 5.1 depend on which Annex A controls you declare applicable; there is no fixed number.
Do topic-specific policies have to be separate documents?
No. The standard requires them to exist and be approved, communicated and reviewed, but sets no format. A small company can group several topics in one document.
How often should policies be reviewed?
At planned intervals and when significant changes occur. An annual review before the management review is common practice.
Is a policy template enough?
As a starting point, yes: it saves the structure and base wording. You still need to adapt it to what the company really does; an unadapted template is a typical audit finding.
Related guides
ISO 27001 internal audit checklist: free Excel template
Free ISO/IEC 27001:2022 internal audit checklist in Excel: clauses 4 to 10 and Annex A controls, how to grade findings and what evidence to ask for.
Read the guide →ISO 27001:2022 mandatory documents and records: checklist by clause
Checklist of the documents and records ISO/IEC 27001:2022 requires, clause by clause, which Annex A documents apply and common audit gaps.
Read the guide →ISO 27001 Statement of Applicability (SoA): example, template and how to write it
What the ISO/IEC 27001:2022 Statement of Applicability must contain, a worked example, 2013 vs 2022 changes, how auditors review it and an Excel template.
Read the guide →Updated: 2026-10-25