Compliance Intelligence Data

{
  "code": "ISO27001-A.5.1",
  "official_title": "Policies for information security",
  "framework": "ISO 27001:2022",
  "domain": "A.5 Organizational Controls",
  "text_paraphrased": "An information security policy and topic-specific policies shall be defined, approved by top management, published, communicated to and acknowledged by relevant personnel and interested parties, and reviewed at planned intervals and on significant change.",
  "evidence_requirements": {
    "categories": ["Policy documentation", "Top management approval", "Communication and acknowledgement", "Periodic and event-driven review"],
    "artefacts": [
      "Signed information security policy with version number and effective date",
      "Topic-specific policies (acceptable use, access control, cryptography, supplier security)",
      "Top management approval evidence: board minutes, signed approval page",
      "Per-user acknowledgement records dated for current staff and contractors",
      "Annual policy review minutes with documented outcome"
    ],
    "common_gaps": [
      "Topic-specific policies missing or stale",
      "Approval at IT director level only; clause requires top management",
      "Annual review treated as calendar event without substantive consideration"
    ],
    "sources": ["ISO/IEC 27001:2022 A.5.1", "ISO/IEC 27002:2022 §5.1", "AICPA TSP-100 CC1.1"],
    "confidence": 97,
    "version": "1.0-verified"
  }
}