The information security policy constitutes the highest level of all security policies. According to ISO/IEC 27000, a policy describes the “intentions and direction of an organization as formally expressed by its top management”. The information security policy (according to ISO/IEC 27001) must support the purpose of the organization and should either include security objectives or provide a framework for establishing these objectives. Furthermore, it must make a commitment for the continual improvement of the ISMS (information security management system). According to the best practices of ISO/IEC 27002, the information security policy should define information security, describe principles for activities relating to information security and contain statements regarding the assignment of responsibilities as well as for handling deviations and exceptions.
