ISO 27001:2022 · Organizational controls
ISO 27001:2022 5.1: Policies for information security
ISO 27001:2022 5.1 covers Policies for information security. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.5.1, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Topic-specific policies referenced in the top policy were never written or have no named....
An overarching information security policy and a set of topic-specific policies are to be written, signed off by management, made available, brought to the attention of the staff and outside parties they concern, confirmed as received by those people, and revisited on a schedule and whenever something significant changes. Purpose (stated in ISO/IEC 27002:2022): keeps the direction and backing management gives to information security suitable, adequate and effective against business, legal, regulatory and contractual needs. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.1.
What evidence supports 5.1?
- Annex A organizational controlStatement of Applicability entry for control A.5.1, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A organizational controlThe top-level information security policy with top management approval, covering the definition, objectives or objective-setting framework, principles, commitments to requirements and continual improvement, role assignments and the exceptions procedure
- Annex A organizational controlThe register of topic-specific policies with an owner, approving manager and version for each
- Annex A organizational controlReview records showing the planned interval met and ad hoc reviews after changes in strategy, technology, regulation, risk, threats or incidents, with management review and audit results as inputs
- Annex A organizational controlAcknowledgement records from personnel and relevant external parties that they understand and will comply
Where this requirement comes from
This is our own statement of ISO 27001:2022 5.1, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Topic-specific policies referenced in the top policy were never written or have no named owner
- Reviews are calendar driven only and ignore significant incidents or regulatory change
- No procedure exists for handling exemptions and exceptions, so exceptions are granted informally
- Acknowledgement collected once at onboarding and never again after policy revisions
How it maps to SOC 2
- CC1.1 low Establishes management commitment to information security policies, reflecting integrity and ethical values.
- CC2.2 high Communicated security policies carry objectives and responsibilities internally.
- CC5.3 high Policies are how control activities are deployed across the entity.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.