Establishment of policies

The organization has an information security policy developed and approved by top management. The policy shall include at least the following:

• the basis for setting the organization’s security objectives
• commitment to meeting information security requirements
• commitment to continuous improvement of the information security management system

In addition, the task owner shall ensure that:

• the is appropriate for the organization's business idea
• the policy is communicated to the entire organization
• the policy is available to stakeholders as appropriate

Theme-specific policy documents can help the communication and viewing of tasks, instructions and other documentation related to different areas, as well as connecting possible upper-level principles to these contents of the management system, which describe a more detailed implementation.

The organization must define which theme-specific policy documents are maintained and, if necessary, reviewed as a whole at desired intervals. Examples of topics for which you may want to maintain your own policy document include:

• access control
• physical security
• management of assets to be protected
• backup
• encryption practices
• data classification
• technical vulnerability management
• secure development

The organization shall have a sufficient number of trained, supervised and, where necessary, properly security cleared personnel who play key roles in information security, performing management tasks related to the information security management system.

The organization has defined:

• what qualifications this staff should have
• how qualifications are acquired and ensured (e.g. through appropriate training and training monitoring)
• how qualifications can be demonstrated through documentation

The owner of the task regularly reviews the number and level of competence of the security personnel.