ISOISO 27001Annex A Controls OverviewEASYFree question
What does control A.5.1 (Policies for information security) require?
- A.A set of policies for information security approved by management, published, and communicated to relevant parties
- B.A single security policy written by the ISMS manager, signed by the auditor, and filed in the register for the next review cycle
- C.A policy approved by the board, translated into three languages, and sent to the certification body
- D.A password standard drafted by IT, reviewed by HR, and stored on the intranet for staff
Why A is correct
A.5.1 requires defining, approving, publishing, and communicating a set of information security policies to relevant personnel and external parties.
Know someone studying for ISO 27001? Send them this one.