Is policy required for each procedure in ISMS ?

[baynoli]

Hi All,

Good Day,

In documentation part of isms, do i really need a policy/ies for each procedure I made?

Cheers Everyone,

Thanks,

klooden

[Stijloor]

A Quick Bump!

Can someone help?

Thank you very much!!

[Colin]

I am not quite sure I understand the question. 27001 requires an ISMS policy (4.2.1 b) and it requires procedures in various areas e.g. for monitoring and reviewing the ISMS.

I don't see the need for a policy for each procedure though it would be normal to define the purpose and scope of each procedure you prepare.

[Richard Regalado]

Colin is correct. You need an information security policy. But not a policy for all of your procedures.

If you are referring to the Annex-A controls, I usually create "sub-policies" for each applicable control and have them in an ISMS manual. BTW, an ISMS manual is not a requirement but I found it very useful to link to other documented information within the ISMS.

For example for Control A.10.4.1 Controls against malicious code, you could have a policy statement which says "All information processing facilities which connect to the organization's network and processes information owned by the organization shall have the official anti-virus software used by the organization and is updated frequently."