ISO 27001 policies and controls: which policies you need and how to manage them

Your policies and control documents say how your organisation protects information: the rules people follow and the procedures they use. The information security policy sits at the top. Beneath it are topic-specific policies (access control, backup, supplier security) and procedures (how to onboard a starter, how to restore a backup).

The goal isn't a big library. It's documents short enough that people read them, accurate enough that they match what happens, and controlled so everyone uses the current version.

Why it matters

• Clause 5.2 of ISO/IEC 27001:2022 requires an information security policy, approved by top management, communicated, and available.
• Annex A 5.1 expects topic-specific policies where needed, approved, communicated and reviewed at planned intervals or when things change.
• Clause 7.5 requires documented information to be controlled: identified, reviewed and approved, versioned, available where needed, and protected.

What you usually need

A small organisation typically covers: the information security policy; acceptable use; access control; asset management and classification; backup; incident management; supplier security; secure development (if you build software); remote working and mobile devices; and business continuity. Your Statement of Applicability tells you which controls each document needs to support.

What an auditor looks for

• An information security policy approved by top management, with commitments to meet requirements and to improve.
• Each document is current: approved, with a version, an owner and a review date that hasn't passed.
• Documents match reality. If the backup policy says nightly, backups run nightly.
• Staff know the relevant ones and can find them.
• Controls in the SoA point to the documents that describe how they're done.

Common reasons it fails: template policies describing processes that don't exist; review dates long past; or staff who've never seen the acceptable use policy.

Common mistakes, and how to keep it manageable

• Writing for the auditor. Write for the people who'll follow the rules, in plain English, and keep each document short.
• Putting changeable details in policies. Name roles, not people, and link to the asset or supplier register rather than listing systems. The policy then survives ordinary change.
• One document per control. Group related controls in one policy; 93 documents is unmanageable.
• Reviewing everything on the same day. Spread review dates across the year.

How to do it in ClearIMS

1. Start from the drafts. The onboarding chat drafts your first policies from what you tell it about your business. They're drafts until a named person approves them.
2. Open Controls and policies and edit each document. The AI can suggest rewrites; you decide what stays.
3. Send for approval. Each document is versioned and goes through review and approval. Approving the information security policy needs a member marked as top management. The AI never approves anything.
4. Link to the SoA and highlight the passages that satisfy each control, so evidence is one click away.
5. Keep them current. Review dates and recurring policy review tasks bring each document round; you can export any document to PDF.

Related pages

• Statement of Applicability: which controls your documents support.
• Policy coverage: spotting gaps across your policies.
• Policy key facts: the facts your policies depend on.
• Exceptions: when a policy can't be followed.