Clause 5.2 Policy
Clause 5.2 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Policy. Top management must set an information security policy that suits the organization's purpose; states the security objectives (6.2) or gives a framework for setting them; commits to meeting applicable information security requirements; and commits to continually improving the ISMS. The policy must exist as documented information, be communicated internally, and be made available, where appropriate, to interested parties.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 5.2 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 5), in our words, not a statement of the standard and not binding on an assessor.
- The approved information security policy signed off by top management
- Policy text showing objectives or an objective-setting framework and the two commitments (to requirements and to continual improvement)
- Communication records such as intranet publication, induction material or acknowledgements
- Where appropriate, evidence that interested parties can obtain the policy, such as a public summary or distribution to suppliers