Skip to main content
Informationssicherheit / NIS2

Information security policy

An information security policy is the binding, management-approved governing document that defines the objectives, roles and requirements for an organisation's information security.

The information security policy is the top-level steering document of an information security management system (ISMS). It is formally approved and put into force by top management, thereby expressing the organisation's binding commitment to information security. In terms of content, it defines the strategic security objectives, the scope, the target level of protection, and the fundamental responsibilities and roles. It forms the framework from which more detailed topic-specific policies, concepts and work instructions (for example on access control, cryptography or business continuity) are derived.

An effective policy is more than a formal compliance artefact: it creates clarity about what is expected of employees, managers and service providers, and makes security verifiably manageable. Typical components include the scope of application, a description of the protection goals of confidentiality, integrity and availability, the assignment of responsibility (in particular the appointment of an information security officer), requirements for risk treatment, rules for handling violations, and a commitment to continual improvement. The policy must be communicated to all relevant persons and reviewed regularly, at least annually or whenever significant changes occur, to keep it up to date.

Legally and in normative terms, the information security policy is central: ISO/IEC 27001 requires in clause 5.2 an information security policy established by management, complemented by topic-specific policies (Annex A 5.1). The German BSI IT-Grundschutz Compendium (module ISMS.1) likewise mandates a security policy as a foundation. With the NIS2 Directive and its German transposition, the document gains additional weight, as the management bodies of essential and important entities must approve and oversee risk management measures, including concepts for the security of information systems. A missing or ineffective policy can therefore directly create compliance and liability risks for the management.

Legal Basis

ISO/IEC 27001:2022 clause 5.2 and Annex A 5.1; BSI IT-Grundschutz ISMS.1; Art. 21 NIS2 Directive (EU) 2022/2555

Practical Example

A mid-sized machinery manufacturer falls under the NIS2 obligations for the first time due to its turnover. The appointed information security officer, together with the IT management, draws up an information security policy defining the protection goals, the scope (all sites and cloud services), responsibilities and the handling of security incidents. Management adopts the document by formal resolution, so that approval of the risk management measures is documented. The policy is then published on the intranet, explained in a training session and given a one-year review cycle, which at the same time lays the groundwork for the subsequent ISO 27001 certification process.

FAQ

The organisation's top management must formally approve the policy and put it into force. In doing so, it documents its commitment to information security. This responsibility cannot be fully delegated, in particular not under the NIS2 Directive.
The overarching information security policy sets strategic objectives and principles, while topic-specific policies define concrete requirements for individual areas such as passwords, access control or cryptography. In practice the terms are often used interchangeably, but hierarchically the topic-specific policies build on the overarching policy.
The policy should be reviewed at planned intervals, usually at least once a year, and additionally whenever significant changes occur, and updated as needed. Changes in the threat landscape, the organisation or the legal situation are typical triggers for an update.

How preeco supports you

Learn how our software supports you with this topic.

Learn more