ISOISO 27001DocumentationEASYFree question
What must the information security policy document include?
- A.A detailed list of the technical controls selected from Annex A, mapped to each asset owner, with the risk acceptance criteria attached
- B.The organization's approach to managing information security, appropriate to its purpose, with a commitment to continual improvement
- C.The scope of the ISMS, the interested parties concerned, with the dated signature of the certification body lead auditor on each controlled copy
- D.Detailed incident handling procedures, named responders for each shift, escalation thresholds, with results from the last exercise
Why B is correct
The policy must be appropriate to the organization's purpose, include a framework for objectives, commit to satisfying requirements, and commit to continual improvement.
Know someone studying for ISO 27001? Send them this one.