ISO27001:2022 - Annex A 5.1 - What’s changed?

Threats to your organisation’s privacy and security are continuously on the rise, and it's more vital than ever to ensure your organisation implements measures to combat these threats. ISO27001 as a standard lays out the requirements to implement an efficient information security system within your organisation and with the introduction of the 2022 version of the ISO27001 standard, these requirements have been recategorised and further clarified. Annex A 5.1 revolves around information security policies, and aims to clarify to an organisation the guidelines by which these should be managed and implemented.

What is an information security policy?

An information security policy establishes the approach and methodologies with which your organisation will approach the security of your sensitive data and assets. At its core, it's a documented set of guidelines, principles, and procedures on how your organisation will be ensuring the confidentiality, integrity, and availability of your information assets. This will typically cover a range of subjects, such as access controls, data classification, incident response, and other various compliance requirements, which may be separated out into their own policy.

Having a clear and defined information security policy serves several critical purposes for your organisation. It provides a framework of expectations and responsibilities for employees to follow to ensure the security of your organisation, establishing a culture of security awareness and accountability. In addition to this, it aids decision-making and planning for company initiatives, security and otherwise, to ensure resources are adequately allocated to address any risks and vulnerabilities. Finally, an information security policy demonstrates your organisation’s commitment to protecting sensitive information which is vital to building customer trust, complying with regulations, and ensuring business continuity.

An information security policy is more than just a document; it’s the very foundation that defines your organisation’s overall security posture and upholds the trust of your stakeholders.

What is Annex A 5.1?

Annex A 5.1 sets out guidance on how these policies should be defined, implemented, and reviewed. At minimum, this means implementing a regularly reviewed information security policy. The goal of this is to begin establishing high and low-level managerial controls to ensure your sensitive information and assets are protected from theft and unauthorised access. These policies should be approved by management and reviewed regularly.

Implementing policies for information security is a continuous process for managing your organisation and its security, and Annex A 5.1 sets out to ensure this is achieved comprehensively. As new threats emerge, new legislations are introduced, and business requirements change, these policies need to be updated to keep your processes secure. Policies are the very backbone of your organisation’s security, and keeping them updated and efficient is the key to your continued security.

Policies and procedures aren't just an ISO27001 thing, and many other sets of standards and guidelines require controls like this to be established. One such example is the NHS DSP (Data Security and Protection Toolkit), a self-assessment tool that must be completed by any organisation that wishes to access NHS data or systems. In terms of the NHS DSP, this links directly to evidence 1.3.1, which requires up-to-date policies in place for data protection and for data and cybersecurity that are approved by management.

So what’s changed?

The changes for this control are simple, as this is not a new control but rather a merging of two controls from the 2013 standard, 5.1.1 Policies for Information Security and 5.1.2 Review of Policies for Information Security. The 2022 version features updates to the description of the purpose of this control and expanded guidance on how it should be implemented. Annex A 5.1 now clearly states that information security policies and procedures should be defined, approved by management, published, communicated to and acknowledged by employees and interested parties where applicable. The new 2022 version of this control specifically states that your organisation’s policies should be reviewed regularly and whenever any changes occur within your organisation that may impact them. Topic-specific policies have now been reworked to include information security incident management, asset management, networking security, information security incident management, and secure development, and some previous policies from the 2013 standard have been removed or merged.

The overall requirements for information security policies in ISO27001:2022 have now become much more comprehensive. Your organisation should now ensure that your policies consider your information security requirements based on your business needs, regulations and legal requirements, and current and potential future information security threats. Your information security policy should:

• Define information security.
• Define roles and responsibilities for your organisation’s information security management.
• Set forth your information security objectives and how these are derived.
• Identify the principles governing your information security activities.
• State your commitment to satisfying requirements for your information security.
• State your commitment to the continual improvement of your organisation’s security.
• Define procedures for how exceptions and exemptions are handled.

How Harpe can help you implement Annex A 5.1

Our security professionals have developed Harpe, a revolutionary tool to cover all your organisation’s security needs. Harpe is the best tool on the market to make compliance with important standards like Cyber Essentials and ISO27001 quick and hassle-free. Harpe features guidance for implementing ISO27001 to the updated 2022 standard with everything you need. Our in-app checklist takes you through every step to implement a robust and secure ISMS within the new requirements.

Harpe provides you with the flexible document system you need for your ISO27001:2022 policies and procedures to help you meet the criteria for Annex A 5.1. With features such as review tracking, approval management, and an online viewer, managing your policies is simple and efficient with Harpe.

With constant updates and fast support, there has never been a better time to chase an ISO27001:2022 certification with Harpe.

‍

_{Image designed by Freepik}