A-5-1 Information security policy

Objective: To provide management direction and support for information security in accordance with business requirements and relevant laws and regulations.

A.5.1.1 Information security policy document

Control

An information security policy document shall be approved by management, and published and communicated to all employees and relevant external parties.

A.5.1.2 Review of the information security policy

Control

The information security policy shall be reviewed at planned intervals or if significant changes occur to ensure its continuing suitability, adequacy, and effectiveness.