What is an information security policy?
An information security policy is the highest-level security document an organization has. Approved by the CEO or the board, it states why the organization protects information, what the security program covers, who is responsible for what, and that compliance is mandatory. Every other security document traces back to it: issue-specific policies, standards, procedures and guidelines all exist to carry out what it requires. It is also called an enterprise information security policy or a security program policy.
What it contains
- Purpose and objectives: protecting the confidentiality, integrity and availability of information, meeting legal and contractual obligations, and supporting the organization's mission.
- Scope: the people, locations, systems and data it applies to, including contractors and third parties.
- Roles and responsibilities: board oversight, the CISO's authority to run the program, the duty of data owners to classify what they own, managers' duty to enforce, and every user's duty to comply and report incidents.
- Supporting documents: the issue-specific policies beneath it, such as acceptable use, access control, incident response and data classification.
- Compliance and exceptions: how compliance is measured, what happens after a violation, and how exceptions are requested and approved.
- Ownership and review: the document owner, approval date and review cycle.
It stays short and general, often a few pages, so it doesn't need rewriting every time a technology changes.
Where it sits in the document hierarchy
| Document | What it says | Example |
|---|---|---|
| Information security policy | What the organization requires and why | Sensitive data must be protected in transit |
| Issue-specific policy | Rules for one area | Staff may connect remotely only through approved, encrypted channels |
| Standard | Mandatory specific values or technologies | TLS 1.2 minimum, TLS 1.3 preferred |
| Procedure | Step-by-step instructions | How to configure TLS on the load balancer |
| Guideline | Recommended, optional advice | Suggested tools for testing cipher settings |
NIST SP 800-12 describes a similar layering of program, issue-specific and system-specific policies.
Why leadership approval matters
The policy is the security team's mandate. When a department pushes back on MFA or an executive asks to skip an access review, the security team can point to a document the CEO or board signed, not to its own preferences. Approval at the top also signals that security is a business priority with funding behind it. Frameworks expect this: ISO/IEC 27001 requires top management to establish an information security policy as part of its leadership clause, and PCI DSS v4.0.1 requires one that is published, kept current, shared with relevant staff and reviewed at least once every 12 months. Employees acknowledge the policy when they join and periodically after that, which makes it enforceable through HR.
Information security policy vs. other documents
- Acceptable use policy: one issue-specific policy beneath it, covering how users may use company systems and data.
- Standard: mandatory but specific. If a document names a key length or a password minimum, it is a standard, not the top-level policy.
- Procedure: explains how to carry out a task. It implements a policy rather than setting requirements of its own.
Information security policy on the CompTIA Security+ exam
The information security policy is one of the policies named in SY0-801 objective 5.1, which covers governance documents. A question asking which document establishes the security program, gives the security team its authority, or defines security responsibilities across the whole organization is pointing at it. Distractors include the acceptable use policy, which is narrower and aimed at users, and standards or procedures, which carry out the policy with specific values and steps. As a control, a policy is managerial and directive: it tells people what to do and relies on other controls to enforce it.