This policy procedure brings your information security rules together in one document, from passwords and remote working to backups, cloud services and supplier security, written for staff to follow.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on information security policies:

• Access Control, Passwords and User Authentication
• Information Classification and Protection
• ISO 27001 Annex A Controls
• Information Security knowledge base

Logo Update Service *

Download this policy with your company name and logo already added!
Document Preparation available with all document toolkits.

How to Download

To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download.

Need Help Implementing?

If you'd like hands-on help assessing your information security risks and controls, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Information Security Policy Procedure Template

The Information Security Policy Procedure is a Word template that sets out your information security arrangements, policies and guidance in one controlled document. It holds a series of named policies as separate sections, from ICT equipment, passwords and remote working to backups, access control, cloud computing, supplier security and information classification, each written as rules for workers to follow.

It gives an ISO 27001 information security management system the topic-specific policies behind its controls in a single document, and refers to the IMS1 manual for how communication is managed.

What the Policy Covers

• Amendment Record, Summary, Scope and Applicability - document control fields, the purpose of the policy, who it applies to, and how sections marked Guidance differ from the rules
• Information Communication Technology (ICT) Equipment Policy - physical security, configuration and disposal of IT equipment
• Use of Own ICT Equipment / Bring Your Own Device (BYOD) Policy - approval and checks of personal devices, and the use and monitoring of communication facilities
• Clear Desk / Clear Screen Policy - key controls for desks, public areas, handheld devices and screens
• Password and Secure Authentication Policy - password strength, password managers and multi-factor authentication
• Remote Working Policy - approval, controls and responsibilities when working away from the office
• Mobile Device Policy - the devices covered and the rules for registering, protecting and reporting them
• Cryptographic Policy - when encryption is used and the approved algorithms
• Information Security in Communications - security points for anyone communicating on behalf of the company
• Data Backup and Deletion Policy - backup management, testing, restoring data and deleting information
• Anti-Malware Policy - malware protection and prevention rules
• Software Installation Policy - approval, licensing, removal of unsafe software and patching
• Access Control Policy - user accounts for new starters, leavers and role changes, physical access and third party access
• Web Content Policy - controls against malicious websites, with the review of user access rights and access control for IT equipment and logins
• Internet / Electronic Messaging Policy - acceptable and unacceptable use, and privacy
• Information Transfer Policy - controls for transferring information internally and externally
• Technical Vulnerability Management Policy - identifying, testing and addressing vulnerabilities
• Secure Coding and Development Policy - secure development and information security in project management
• Cloud Computing Policy - approval of cloud services, terms of service and the cloud computing register
• Identity Management / Authentication Information - logins and identities, secret authentication information, user de-registration and user responsibilities
• Supplier Security Policy - appraisal, agreements and monitoring of suppliers with access to information assets
• Information Classification and Protection Policy - labelling, and a table of protection and storage rules for Confidential, Business Use and Public information
• ICT Continuity Policy - continuity arrangements and recovery objectives for critical ICT
• Intellectual Property Policy - copyright checks and licence conditions

Who Needs an Information Security Policy Procedure?

Organisations working towards ISO 27001, and any business that needs written information security rules for its staff, for example to answer a customer security questionnaire. It suits small and medium-sized businesses that would rather maintain one policy procedure than a large set of separate policy documents.

Using the Policy Procedure

Complete the document control fields, then read each section against how your business works. Adjust the rules to match your own systems, remove any policy that does not apply, and record each change in the amendment record. The policy refers to registers such as the Equipment Logins Register, the Cloud Computing register and the personal data register, so set these up alongside it.

Pairs with the Information Security Staff Handbook

Give staff the same rules in plain language with INF1-1 Information Security Staff Handbook, and use toolbox talks such as TT-8-01 Information Security - General and TT-8-04 Access Control and User Authentication for short briefings. Personal data is covered in more depth by P-25 Data Protection Policy.