Zum Hauptinhalt springen
CENEDRIL WIKI
DE
Starter Kit · Policy

Information Security Policy

Updated on 7 min Reviewed by: Cenedril Editorial
Clause 4.1Clause 4.2Clause 4.3Clause 4.4Clause 5.1Clause 5.2Clause 5.3Clause 7.1Clause 7.3Clause 7.5Clause 8.1Clause 9.1Clause 9.2Clause 9.3Clause 10.1Clause 10.2A.5.1A.5.2A.5.4 ISO 27001NIS2BSI ISMS.1

The Information Security Policy is the top-level document of your ISMS. Every topic-specific policy — from access control through cryptography to HR security — derives its authority from this single document. If you are going to get one policy right, make it this one.

ISO 27001 devotes the entirety of Clauses 4 through 10 to the subjects this policy addresses: organisational context, leadership, planning, support, operation, performance evaluation and improvement. BSI IT-Grundschutz anchors it in ISMS.1 (Security Management), ORP.1 (Organisation), ORP.3 (Awareness and Training) and ORP.5 (Compliance Management). NIS2 presupposes the existence of a documented information security concept. Further down you will find the complete template in English and German.

What does it actually cover?

Every ISMS needs a document that answers the fundamental questions: Why do we practise information security? What is the scope of the system? Who bears which responsibilities? And how do we ensure that the whole thing works and keeps improving? The Information Security Policy answers exactly these questions — and provides the framework for every other policy.

The template begins with the organisational context (Clause 4.1): which external factors influence your ISMS — threat landscape, regulation, customer requirements? Which internal factors matter — organisational structure, business processes, technology landscape, personnel competence? From there it derives the requirements of interested parties (Clause 4.2) and the scope (Clause 4.3).

From Clause 5 onwards things get concrete: leadership commitment, role assignments, resources. Clause 6 covers planning — risk management, information security objectives, change planning. Clauses 7 and 8 address the operational foundation: competence, awareness, communication, document control, operational control. Clauses 9 and 10 close the loop with monitoring, audit, management review and continual improvement.

Why does it matter so much?

Audit entry point. The Information Security Policy is the first document auditors request. They check whether the policy reflects the strategic context, whether top management has approved it, and whether it functions as the framework for all downstream documents. If this document is solid, the audit starts on good footing.

Leadership commitment becomes tangible. Clause 5.1 requires top management to provide resources, communicate the importance of information security and participate in training themselves. These commitments are recorded in the policy — which means they can be referenced during annual reviews or budget discussions.

Bridge between strategy and operations. Without this document, topic-specific policies exist in isolation. The Information Security Policy links business objectives to security objectives, defines measurable KPIs and ensures that results are reported to top management at regular intervals.

What goes into it?

The template covers 21 sections — here are the most important thematic blocks:

  • Legal basis and regulatory framework — ISO 27001, ISO 27002, BSI ISMS.1/ORP.1/ORP.3/ORP.5, sector-specific laws from the legal register
  • Context, interested parties, scope (4.1–4.3) — external and internal factors, requirements from customers, regulators, employees; ISMS boundaries and interfaces with third parties
  • Leadership and commitment (5.1–5.3) — resource allocation, integration into business processes, role assignment (top management, ISO, DPO, department heads, asset owners, all personnel) with RACI matrix
  • Risk management (6.1) — reference to the Risk Management Policy for methodology, risk acceptance criteria and the Statement of Applicability (SoA)
  • Information security objectives (6.2) — measurable objectives at relevant levels, with responsibilities, timelines and evaluation methods
  • Competence, awareness, communication (7.2–7.4) — competence matrix, training programme, awareness campaigns, internal and external communication plan
  • Document control (7.5) — document hierarchy, creation and approval process, version control, retention
  • Operational control (8.1) — reference to topic-specific policies for access control, asset management, IT operations, incident management, supplier management and more
  • Monitoring and KPIs (9.1) — KPIs such as risk acceptance rate, control implementation status, training completion rates, incident metrics, audit findings
  • Internal audit and management review (9.2–9.3) — audit programme, auditor independence, management review inputs and outputs
  • Continual improvement and corrective actions (10) — handling nonconformities, root cause analysis, CAPA register

How to roll it out

  1. 01

    Determine context and scope

    Before you write the policy, you need clarity on three questions: which external factors influence your ISMS (regulation, threat landscape, customer requirements)? Which internal factors are relevant (organisational structure, IT landscape, personnel capacity)? And where exactly are the scope boundaries — which locations, departments and systems are included, and what interfaces exist with third parties? The answers feed directly into sections 2.1 through 2.3 of the template.

  2. 02

    Assign roles and responsibilities

    The template defines six key roles: top management, ISO, DPO, department heads, asset owners and all personnel. For each role you need a named individual or a designated function. The result is a RACI matrix showing who is accountable, responsible, consulted or informed for each ISMS responsibility. Without this assignment, accountability stays theoretical.

  3. 03

    Adapt the template and replace placeholders

    Our template contains placeholders like [YOUR_ORGANISATION_NAME], [POLICY_OWNER_ROLE] and [INDUSTRY_SECTOR]. Replace all of them. At the same time, check which sections apply to your organisation: do you have a DPO? Do you develop software? Which sector-specific regulation applies? Remove what is irrelevant — but document in the ISMS scope statement why an area was excluded.

  4. 04

    Get top management approval

    The Information Security Policy is one of the few documents that ISO 27001 explicitly requires top management to approve (Clause 5.2). Prepare a brief management summary: one-page overview of the policy, explanation of the leadership commitment, resource requirements. Top management needs to understand what they are approving — and what consequences follow.

  5. 05

    Communicate and embed in daily operations

    After approval, communicate the policy to all personnel. The template includes a communication plan (section 12) — use it as a starting point. Beyond that: integrate the policy into the onboarding process for new hires, reference it in annual awareness training, and make sure the current version is accessible at all times. The policy only becomes effective when the people in the organisation know about it.

Where it goes wrong in practice

From audit experience, sorted by frequency:

1. Policy without context. The sections on external/internal factors and interested parties are empty or filled with generic phrasing. Auditors spot immediately whether someone has engaged with the actual business environment. A sentence like “we operate in a dynamic environment” is recognisably insufficient as a context analysis.

2. Leadership commitment on paper only. Top management signed the policy but cannot describe its contents. In audit interviews, senior leaders are questioned directly — if they cannot name the information security objectives or the risk acceptance criteria, that signals a lack of commitment.

3. Scope defined unclearly. Which locations, departments and systems does the ISMS cover? Where are the boundaries? Without clear answers, blind spots emerge — and auditors specifically probe areas at the edge of the scope.

4. Roles assigned but never lived. The RACI matrix exists, but asset owners do not know they are supposed to approve access requests. Department heads are unaware of their responsibility for department-specific risks. The assignment only works when it is communicated and integrated into working processes.

5. KPIs defined but never measured. Section 17 of the template lists KPIs such as control implementation rate, training completion rate and incident metrics. When these KPIs appear in the policy but are never measured or reported, there is no evidence that the ISMS is effective.

Template: Information Security Policy

Full policy text

Information Security Policy

.md · EN.md · DE

Document control
Owner: [POLICY_OWNER_ROLE, e.g. Information Security Officer]
Approved by: [APPROVER_NAME_AND_ROLE]
Version: [VERSION]
Effective date: [EFFECTIVE_DATE]
Next review: [NEXT_REVIEW_DATE]

1. Legal/Regulatory Basis

ISO/IEC 27001:2022 — Information Security Management Systems (Clauses 4–10).

ISO/IEC 27002:2022 — Information Security Controls (Annex A reference controls).

BSI IT-Grundschutz:

  • ISMS.1 (Security Management)
  • ORP.1 (Organisation)
  • ORP.3 (Awareness and Training for Information Security)
  • ORP.5 (Compliance Management)

Additional jurisdiction-specific laws and regulations that apply to [YOUR_ORGANISATION_NAME] are listed in the Legal Register and are incorporated by reference. Typical examples include data protection laws (e.g. GDPR), sector-specific regulations (e.g. NIS2, DORA, HIPAA) and contractual security requirements from key customers.

2. Purpose & Scope (4.1–4.4)

This Information Security Policy establishes the principles, objectives and framework for the Information Security Management System (ISMS) of [YOUR_ORGANISATION_NAME]. It serves as the overarching governance document from which all topic-specific policies and supporting management documents derive their authority.

2.1 Context of the Organisation (4.1)

[YOUR_ORGANISATION_NAME] operates in the [INDUSTRY_SECTOR] sector.

External factors influencing the ISMS include the evolving cyber-threat landscape, applicable legislation and regulatory requirements, customer and partner expectations, and industry standards.

Internal factors include the organisational structure, business processes, information assets, technology infrastructure, and the competence and awareness of personnel.

2.2 Interested Parties (4.2)

The needs and expectations of interested parties relevant to the ISMS are identified, documented and regularly reviewed. Interested parties include customers, business partners, regulators and supervisory authorities, shareholders, employees and contractors. Their requirements are recorded in the Stakeholder Register and are considered when establishing and maintaining the ISMS.

2.3 Scope of the ISMS (4.3)

The ISMS applies to all information assets, business processes, IT systems and personnel within the defined scope of [YOUR_ORGANISATION_NAME]. The locations and departments in scope are listed in the ISMS Scope Statement.

The scope boundaries, including interfaces with external parties and services not covered by the ISMS, are documented in the ISMS Scope Statement. The scope is reviewed at least annually and updated when significant changes occur.

2.4 The ISMS (4.4)

[YOUR_ORGANISATION_NAME] establishes, implements, maintains and continually improves an Information Security Management System in accordance with ISO/IEC 27001:2022. The ISMS encompasses all processes needed to plan, implement, monitor and improve information security, including the management of risks and the achievement of information security objectives.

3. Leadership & Commitment (5.1)

Top management demonstrates leadership and commitment to the ISMS by:

  • Establishing this Information Security Policy and the information security objectives, ensuring their compatibility with the strategic direction of the organisation.
  • Ensuring that the ISMS requirements are integrated into business processes across all operational areas.
  • Providing the resources — financial, human and technical — necessary for the establishment, implementation, maintenance and continual improvement of the ISMS.
  • Communicating the importance of effective information security management and of conforming to the ISMS requirements to all personnel.
  • Ensuring that the ISMS achieves its intended outcomes through regular performance evaluation and management review.
  • Directing and supporting personnel to contribute to the effectiveness of the ISMS, and supporting other relevant management roles to demonstrate their leadership in their areas of responsibility.
  • Promoting the continual improvement of the ISMS.
  • Participating in mandatory information security training for management bodies. Members of top management maintain current knowledge of cyber risks, threat landscapes and their governance obligations.

4. Information Security Policy Statement (5.2)

[YOUR_ORGANISATION_NAME] is committed to protecting the confidentiality, integrity and availability of all information assets. This commitment extends to information in all forms — digital, physical and verbal — throughout its lifecycle.

This policy:

  • Is appropriate to the purpose and context of the organisation.
  • Provides a framework for setting information security objectives.
  • Includes a commitment to satisfy applicable requirements related to information security.
  • Includes a commitment to the continual improvement of the ISMS.

This policy is communicated within the organisation, is available to all personnel, and is made available to relevant interested parties as appropriate.

5. Roles & Responsibilities (5.3)

Top management assigns and communicates roles, responsibilities and authorities relevant to information security. The following key roles are established:

  • Top Management / Executive Board: Bears overall accountability for the ISMS. Approves this policy, allocates resources, sets risk acceptance criteria and reviews ISMS performance in the management review.
  • Information Security Officer (ISO): Ensures that the ISMS conforms to ISO 27001 requirements and reports ISMS performance to top management. Coordinates the implementation of security controls and serves as the primary point of contact for information security matters.
  • Data Protection Officer (DPO): Advises on data protection requirements, monitors compliance with data protection legislation and cooperates with supervisory authorities. Works in close coordination with the ISO on matters where information security and data protection intersect.
  • Department Heads / Line Managers: Ensure that information security requirements are implemented within their areas of responsibility. Identify department-specific risks and ensure that personnel are aware of and trained in applicable security procedures.
  • Asset Owners: Are responsible for the classification, protection and lifecycle management of assigned information assets. Define access requirements and approve access requests for their assets.
  • All Employees & Contractors: Comply with this policy and all applicable topic-specific policies. Report information security events and suspected weaknesses through established reporting channels.

The complete assignment of responsibilities to specific persons is documented in the RACI matrix. The RACI matrix maps each ISMS responsibility to the accountable, responsible, consulted and informed parties.

6. Risk Management (6.1)

6.1 Actions to Address Risks and Opportunities (6.1.1)

[YOUR_ORGANISATION_NAME] considers the issues identified in the context analysis (4.1) and the requirements of interested parties (4.2) when planning the ISMS. Actions are determined to address risks and opportunities that could affect the ability of the ISMS to achieve its intended outcomes, to prevent or reduce undesired effects, and to achieve continual improvement.

6.2 Information Security Risk Assessment (6.1.2)

A documented information security risk assessment process is established that identifies, analyses and evaluates information security risks. The risk assessment methodology, including risk acceptance criteria, assessment scales and the systematic approach to risk identification through risk sources, threats and vulnerabilities, is defined in the Risk Management Policy. Risk assessments are performed at planned intervals and when significant changes occur.

6.3 Information Security Risk Treatment (6.1.3)

A risk treatment process is established to select appropriate risk treatment options (risk modification, risk retention, risk avoidance, risk sharing) and to determine the controls necessary to implement those options. Selected controls are compared against the ISO 27001 Annex A control set to verify completeness. The Statement of Applicability (SoA) documents all applicable controls, their justification and implementation status. Residual risks are formally accepted by risk owners.

7. Information Security Objectives (6.2)

[YOUR_ORGANISATION_NAME] establishes information security objectives at relevant functions and levels. The objectives are consistent with this policy, are measurable where practicable, take into account applicable requirements and the results of risk assessment and treatment, and are monitored, communicated and updated as appropriate.

For each objective, the following is determined: what is to be done, what resources are required, who is responsible, when it is to be completed, and how the results are evaluated. The information security objectives and the plans to achieve them are documented in the ISMS Objectives register.

8. Planning of Changes (6.3)

Changes to the ISMS are carried out in a planned manner. When a need for change is identified, the following are considered: the purpose of the change and its potential consequences, the integrity of the ISMS, the availability of resources, and the allocation or reallocation of responsibilities and authorities. Changes are documented and communicated to affected parties before implementation.

9. Resources (7.1)

[YOUR_ORGANISATION_NAME] determines and provides the resources needed for the establishment, implementation, maintenance and continual improvement of the ISMS. This includes qualified personnel, appropriate technology and tools, adequate budget allocation and sufficient time for security-related activities. Resource requirements are reviewed as part of the annual management review and adjusted when significant changes in scope, risk profile or regulatory requirements occur.

10. Competence (7.2)

Personnel performing work that affects information security performance possess the necessary competence based on appropriate education, training or experience. Competence requirements are defined for each ISMS role in the competence matrix. Where gaps are identified, actions are taken to acquire the necessary competence — through training, mentoring, reassignment or recruitment. The effectiveness of these actions is evaluated and documented.

Training records, certifications and evidence of competence are retained as documented information. The training programme covers general information security awareness, role-specific technical competencies and specialised topics such as incident response, risk assessment and secure development.

11. Awareness (7.3)

All personnel working under the control of the organisation are aware of:

  • This Information Security Policy and its relevance to their work.
  • Their contribution to the effectiveness of the ISMS, including the benefits of improved information security performance.
  • The implications of not conforming to the ISMS requirements, including disciplinary consequences.

Awareness is established through an ongoing programme that includes onboarding security briefings, annual refresher training, targeted campaigns on current threats (such as phishing, social engineering and ransomware) and regular communications from the Information Security Officer. Training completion and acknowledgement are tracked and reported to management.

12. Communication (7.4)

[YOUR_ORGANISATION_NAME] determines the internal and external communications relevant to the ISMS, including what is communicated, when, with whom and how. The communication plan covers:

  • Internal communication: ISMS performance updates to management, policy changes to all personnel, security alerts and advisories, incident notifications to affected parties, and training schedule announcements.
  • External communication: Regulatory notifications and incident reports to supervisory authorities, contractual security assurances to customers and partners, and information sharing with industry groups and CERTs.

The detailed communication plan — including topics, frequencies, responsible parties and communication channels — is documented in the ISMS Communication Plan.

13. Documented Information (7.5)

The ISMS includes documented information required by ISO 27001 and documented information determined by the organisation to be necessary for ISMS effectiveness. Documented information is created, updated and controlled according to the ISMS Governance Policy framework, which defines:

  • Document hierarchy: This Information Security Policy and the Risk Management Policy at the top, followed by topic-specific policies covering individual security domains, supporting management documents, and operational records. The full hierarchy and topic coverage is described in the ISMS Governance Policy.
  • Creation and approval: Each document follows a defined lifecycle from draft through review and approval to publication, with identified authors, reviewers and approvers.
  • Version control: All changes to documented information are tracked with version history, change descriptions and approval records.
  • Distribution and access: Current versions are available to all personnel who need them. Obsolete versions are removed from active use but remain queryable for audit and historical reference.
  • Retention: Documented information is retained for a minimum period consistent with statutory, regulatory and contractual requirements. The retention defaults are reviewed against the Legal Register and the data retention plan, and longer statutory periods take precedence where they apply.

14. Operational Planning & Control (8.1)

[YOUR_ORGANISATION_NAME] plans, implements and controls the processes needed to meet information security requirements and to implement the actions determined in Clause 6. This includes establishing criteria for the processes, implementing control of the processes in accordance with those criteria, and retaining documented information to demonstrate that processes have been carried out as planned.

Operational planning encompasses the following areas, each governed by a dedicated topic-specific policy:

  • Access control and identity management: Provisioning, review and de-provisioning of user accounts and privileges.
  • Asset management: Inventory, classification and lifecycle management of information assets.
  • IT operations: Network security, logging, monitoring, backup and disaster recovery.
  • Endpoint security and malware protection: Device management, anti-malware and patch management.
  • Incident management: Detection, reporting, triage, response, forensics and lessons learned.
  • Business continuity: Business impact analysis, continuity planning, testing and crisis communication.
  • Supplier management: Supplier assessment, monitoring, contractual security requirements and SBOM management.
  • Secure development: Secure development lifecycle, code review, testing and deployment controls.
  • Cryptography: Key management, algorithm selection and cryptographic inventory.
  • Configuration and change management: Baseline configurations, change control and deployment procedures.
  • Physical security: Facility access, environmental controls and equipment protection.
  • Human resource security: Pre-employment screening, onboarding, awareness and offboarding.

Planned changes are controlled and the consequences of unintended changes are reviewed. Outsourced processes that affect the ISMS are identified and controlled through supplier agreements and monitoring.

15. Information Security Risk Assessment (8.2)

[YOUR_ORGANISATION_NAME] performs information security risk assessments at planned intervals — at least annually — and when significant changes are proposed or occur. Risk assessments follow the methodology defined in the Risk Management Policy and consider changes to business requirements, the threat landscape, the technology environment, legal and regulatory requirements and the results of incident investigations. The results of risk assessments are documented and retained.

16. Information Security Risk Treatment (8.3)

The risk treatment plan is implemented in accordance with the priorities and timelines established during risk assessment. Implementation progress is tracked, and deviations from planned timelines are escalated to risk owners. The results of risk treatment are documented and retained. The effectiveness of implemented controls is evaluated through monitoring, testing and audit activities described in this policy.

17. Monitoring, Measurement, Analysis & Evaluation (9.1)

[YOUR_ORGANISATION_NAME] determines what needs to be monitored and measured, including information security processes and controls. The following is established:

  • Methods: Appropriate methods for monitoring, measurement, analysis and evaluation are selected to produce valid and comparable results.
  • Timing: When monitoring and measuring is performed and when results are analysed and evaluated.
  • Responsibility: Who monitors, measures, analyses and evaluates.

Key performance indicators for the ISMS include:

  • Percentage of risks within the defined acceptance threshold.
  • Control implementation status from the Statement of Applicability.
  • Open risk treatment actions and their completion rates.
  • Training completion rates across all personnel.
  • Incident metrics: count, mean time to detect (MTTD), mean time to respond (MTTR), and trend analysis.
  • Vulnerability management: open vulnerabilities, SLA compliance, remediation rates.
  • Audit findings: open findings, corrective action completion rates.
  • Policy compliance: document completeness and review timeliness.

Results are documented and reported to top management through the management review process. Penetration tests and vulnerability assessments are conducted at planned intervals to validate the effectiveness of technical controls.

18. Internal Audit (9.2)

[YOUR_ORGANISATION_NAME] conducts internal audits at planned intervals to provide information on whether the ISMS conforms to the organisation's own requirements and to the requirements of ISO 27001, and whether the ISMS is effectively implemented and maintained.

The internal audit programme considers the importance of the processes concerned, the results of previous audits and changes to the ISMS. Audit criteria, scope, frequency and methods are defined for each audit. Auditors are selected to ensure objectivity and impartiality — auditors do not audit their own work.

Audit results, including identified nonconformities and improvement opportunities, are documented in audit reports and communicated to relevant management. The audit programme, individual audit plans and audit reports are retained as documented information. The detailed audit framework is defined in the Internal Audit Programme and the Internal Audit Procedure.

19. Management Review (9.3)

Top management reviews the ISMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness. The management review considers:

  • The status of actions from previous management reviews.
  • Changes in external and internal issues relevant to the ISMS.
  • Feedback on information security performance, including trends in nonconformities and corrective actions, monitoring and measurement results, audit results, and fulfilment of information security objectives.
  • Feedback from interested parties.
  • Results of risk assessment and status of the risk treatment plan.
  • Opportunities for continual improvement.

The outputs of the management review include decisions and actions related to continual improvement opportunities and any need for changes to the ISMS, including changes to resources. Management review results are documented in minutes that record decisions, action items, responsible parties and deadlines.

20. Continual Improvement (10.1)

[YOUR_ORGANISATION_NAME] continually improves the suitability, adequacy and effectiveness of the ISMS. Improvement inputs are derived from the analysis and evaluation of monitoring results, audit findings, management review outputs, incident investigations, risk assessment updates and feedback from interested parties. Improvement initiatives are prioritised, planned, implemented and their effectiveness evaluated.

21. Nonconformity & Corrective Action (10.2)

When a nonconformity occurs, the following steps are taken:

  • React to the nonconformity: Take action to control and correct it, and deal with the consequences.
  • Evaluate the need for action: Determine whether similar nonconformities exist or could potentially occur, by reviewing the nonconformity, determining its causes and identifying whether comparable situations exist elsewhere.
  • Implement corrective action: Implement any action needed to address the root cause and prevent recurrence.
  • Review effectiveness: Review the effectiveness of corrective actions taken.
  • Update the ISMS: Make changes to the ISMS if necessary based on the corrective action review.

Corrective actions are appropriate to the effects of the nonconformities encountered. Evidence of the nature of nonconformities, actions taken and the results of corrective actions are retained as documented information in the corrective and preventive action (CAPA) register.

Sources

ISO 27001 Controls Covered

Clause 4.1 Understanding the organisation and its context Clause 4.2 Understanding the needs and expectations of interested parties Clause 4.3 Determining the scope of the ISMS Clause 4.4 Information security management system Clause 5.1 Leadership and commitment Clause 5.2 Information security policy Clause 5.3 Organisational roles, responsibilities and authorities Clause 7.1 Resources Clause 7.3 Awareness Clause 7.5 Documented information Clause 8.1 Operational planning and control Clause 9.1 Monitoring, measurement, analysis and evaluation Clause 9.2 Internal audit Clause 9.3 Management review Clause 10.1 Continual improvement Clause 10.2 Nonconformity and corrective action A.5.1 Policies for information security A.5.2 Information security roles and responsibilities A.5.4 Management responsibilities

Frequently asked questions

Do I need a separate Information Security Policy if I already have topic-specific policies?

Yes. ISO 27001 Clause 5.2 requires an overarching policy that sets the framework for all topic-specific documents. Without it, the strategic umbrella is missing — auditors ask for this document first.

How long does the policy need to be?

There is no minimum length. The policy must address the requirements of Clauses 4–10, but detailed rules belong in topic-specific policies. Our template has roughly 20 sections — that is sufficient for an SME. Cut sections that do not apply to your organisation.

Who must approve the policy?

Top management. ISO 27001 Clause 5.2 requires the policy to be approved at the highest level of the organisation. Approval by the Information Security Officer alone does not satisfy the audit requirement — top management bears overall accountability for the ISMS.

How often must I review the policy?

At least annually, typically as part of the management review. Additionally after significant changes — such as restructuring, a shift in business model or new regulatory requirements. The template includes a version table to document this.

What is the difference between the Information Security Policy and the Risk Management Policy?

The Information Security Policy defines the overall concept: scope, objectives, roles, leadership commitment. The Risk Management Policy describes the methodology for risk assessment and treatment in detail. The Information Security Policy references the Risk Management Policy — and the Risk Management Policy derives its authority from the Information Security Policy.