Information Security (and Privacy) Policy Template

An Information Security Policy is generally an overarching document that serves as the guide for all sub-policies. Organizations may prefer to mandate a single, succinct, broad governance-type policy, supported by a suite of detailed information risk, security, compliance, privacy, and other policies, procedures, and guidelines.

Some organizations prefer to combine all policies into this document or take a hybrid approach.

Commonly associated evidence:

• Information Security Policy

• Information Security Policy Review

Who needs a policy like this?

• All businesses

• For businesses that are ISO 27001 compliant, use this template. It includes a required section on defending and measuring ISMS (+PIMS) objectives:

  ISMS PIMS Information Security Policy Template

How to use the template:

• Click on the link above to access the template

  • If you are a Google Workplace organization, make a copy by going to File > Make a copy

  • If you are not a Google Workplace organization, download a copy by going to File > Download and selecting your preferred file type (available as DOCX, PDF, and more)

• Review and then remove instructional text

• Save in a centralized place

• Attach to evidence either through Integrations, Automated Collection, or direct upload

If you need help using the template, please let us know.