ISO 27001:2022
Organizational controls – ISO 27001:2022

ISO 27001:2022 5.1: Policies for information security

An overarching information security policy and a set of topic-specific policies are to be written, signed off by management, made available, brought to the attention of the staff and outside parties they concern, confirmed as received by those people, and revisited on a schedule and whenever something significant changes. Purpose (stated in ISO/IEC 27002:2022): keeps the direction and backing management gives to information security suitable, adequate and effective against business, legal, regulatory and contractual needs. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.1.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 151 controls across 39 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 16 controls

FedRAMP High · 15 controls

  • AC-1 Policy and Procedures
  • AT-1 Policy and Procedures
  • AU-1 Policy and Procedures
  • CA-1 Policy and Procedures
  • CM-1 Policy and Procedures
  • CM-11 User-Installed Software
  • MA-1 Policy and Procedures
  • PL-1 Policy and Procedures
  • PL-2 System Security and Privacy Plans
  • PL-8 Security and Privacy Architectures
  • PS-1 Policy and Procedures
  • RA-1 Policy and Procedures
  • SC-1 Policy and Procedures
  • SI-1 Policy and Procedures
  • SR-1 Policy and Procedures (SR-1)

FedRAMP Moderate · 15 controls

  • AC-1 Policy and Procedures
  • AT-1 Policy and Procedures
  • AU-1 Policy and Procedures
  • CA-1 Policy and Procedures
  • CM-1 Policy and Procedures
  • CM-11 User-Installed Software
  • MA-1 Policy and Procedures
  • PL-1 Policy and Procedures
  • PL-2 System Security and Privacy Plans
  • PL-8 Security and Privacy Architectures
  • PS-1 Policy and Procedures
  • RA-1 Policy and Procedures
  • SC-1 Policy and Procedures
  • SI-1 Policy and Procedures
  • SR-1 Policy and Procedures (SR-1)

PCI DSS 4.0 · 14 controls

  • 1.1.1 1.1.1 Requirement 1 policies and procedures governed
  • 1.2.1 1.2.1 Ruleset configuration standards for NSCs
  • 11.1.1 11.1.1 Requirement 11 policies and procedures managed
  • 12.1.1 12.1.1 Overall information security policy established and disseminated
  • 12.1.2 12.1.2 Security policy reviewed annually and updated as needed
  • 2.1.1 2.1.1 Requirement 2 policies and procedures governed
  • 4.1.1 4.1.1 Requirement 4 policies and procedures maintained and communicated
  • 5.1.1 5.1.1 Requirement 5 policies and procedures maintained and communicated
  • 6.1.1 6.1.1 Requirement 6 policies and procedures maintained and communicated
  • 7.1.1 7.1.1 Requirement 7 policies and procedures maintained
  • 8.3.8 8.3.8 Authentication policies communicated to users
  • 9.1.1 9.1.1 Requirement 9 policies and procedures maintained
  • 3.1.1 3.1.1 Requirement 3 policies and procedures maintained and in use
  • 8.1.1 8.1.1 Requirement 8 policies and procedures maintained

ISO/IEC 42001:2023 · 11 controls

  • 4.4 AI management system
  • 5.1 Leadership and commitment
  • 5.2 AI policy
  • 7.5 Documented information
  • 7.5.3 Control of documented information
  • A.2 Policies related to AI
  • A.2.2 AI policy
  • A.2.3 Alignment with other organizational policies
  • A.2.4 Review of the AI policy
  • A.9.3 Objectives for responsible use of AI system
  • A.9.4 Intended use of the AI system

ISO 27701:2019 · 9 controls

  • 5.1 General
  • 5.3 Leadership
  • 5.3.1 Leadership and commitment
  • 5.3.2 Policy
  • 5.4 Planning
  • 5.4.1 Actions to address risks and opportunities
  • 5.4.2 Information security objectives and planning to achieve them
  • 6.2 Information security policies
  • 6.2.1 Management direction for information security

ISO 22301:2019 · 6 controls

  • 4.4 Business continuity management system
  • 5.1 Leadership and commitment
  • 5.2 Policy
  • 5.2.1 Establishing the business continuity policy
  • 5.2.2 Communicating the business continuity policy
  • 6.1 Actions to address risks and opportunities

NIST Cybersecurity Framework 2.0 · 6 controls

  • NIST-CSF-GV.OC-01 The organizational mission is understood and informs cybersecurity risk management
  • NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission
  • NIST-CSF-GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders
  • NIST-CSF-GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained
  • NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated

C5 (Germany) · 5 controls

  • C5-OIS-01 Information Security Management System (ISMS)
  • C5-OIS-02 Information Security Policy
  • C5-OIS-06 Risk Management Policy
  • C5-SP-01 Documentation, communication and provision of policies and instructions
  • C5-SP-02 Review and Approval of Policies and Instructions

HIPAA Security Rule · 5 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

NIST SP 800-66 Rev 2 · 4 controls

SOC 2 · 4 controls

  • SOC2-CC1.1 CC1.1 Commitment to integrity and ethical values (COSO principle 1)
  • SOC2-CC2.2 CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)
  • SOC2-CC5.3 CC5.3 Deploying controls through policies and procedures (COSO principle 12)
  • SOC2-PI1.3 PI1.3 Controls over system processing

APRA CPS 230 Operational Risk Management · 3 controls

  • CPS230-13 Board Accountability for Operational Risk Management
  • CPS230-15 Operational Risk Elements of the Risk Management Framework
  • CPS230-37 Service Provider Management Policy

APRA CPS 234 · 3 controls

  • CPS234-13 Board Responsibility for Information Security
  • CPS234-19 Information Security Policy Framework
  • CPS234-P19 Policy Direction to All Responsible Parties

NIS2 Directive · 3 controls

  • Art.20.1 Management body approves the cybersecurity risk-management measures and oversees their implementation
  • Art.21.1 Take proportionate all-hazards measures calibrated to the entity's own risk exposure
  • Art.21.2.a Policies on risk analysis and on information system security

Australia My Health Records Act 2012 · 2 controls

  • MYHR-REG-3 Conditions of registration and participation
  • MYHR-SEC-1 Written security and access policy

Azure Security Benchmark · 2 controls

  • ASBv3-GS-3 Define and implement data protection strategy
  • ASBv3-GS-6 Define and implement identity and privileged access strategy

COBIT 2019 · 2 controls

  • APO01.09 APO01.09 Define and communicate policies and procedures
  • MEA03.02 MEA03.02 Optimize response to external requirements

DORA · 2 controls

ISO 27001:2013 · 2 controls

  • A.5.1.1 Policies for information security
  • A.5.1.2 Review of the policies for information security

AWS Well-Architected Security Pillar · 1 control

  • SEC01-BP03 Identify and validate control objectives

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-STEP1 Step 1 - Define and implement security governance for CDR data

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-1 Program of Risk Analysis and Oversight

CIS Controls v8 · 1 control

  • CIS-15.2 Establish and Maintain a Service Provider Management Policy

CMMC 2.0 · 1 control

EU AI Act · 1 control

ISO 14001:2015 · 1 control

  • 5.1 Leadership and commitment

ISO 22000:2018 · 1 control

  • 5.1 Leadership and commitment

ISO 27002:2022 · 1 control

  • 5.1 Policies for information security

ISO 37001:2016 · 1 control

  • 5.1 5.1 Leadership and commitment

ISO 37301:2021 · 1 control

  • 5.1 Leadership and commitment

ISO 45001:2018 · 1 control

  • 5.1 Leadership and commitment

ISO 50001:2018 - Energy Management Systems · 1 control

  • 5.1 Leadership and commitment

ISO 55001:2014 · 1 control

  • 5.1 Leadership and commitment

ISO 9001:2015 · 1 control

  • 5.1 Leadership and commitment

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-171 Rev 3 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Organizational controls – ISO 27001:2022

You are reading one control. How much of ISO 27001:2022 have you already done?

ISO 27001:2022 5.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27001:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27001:2022 controls already carry evidence.

If you hold NIST SP 800-53 Rev 584.9% covered · 14 gapsIf you hold ISO 27001:201383.9% covered · 15 gapsIf you hold FedRAMP Moderate80.6% covered · 18 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.174.2% covered · 24 gapsIf you hold C5 (Germany)69.9% covered · 28 gapsIf you hold NIST Cybersecurity Framework 2.063.4% covered · 34 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 170 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 151 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ISO 27001:2022 controls