ISO 27001 Policy Requirements Explained

The ISO 27001 Documentation Trap

Organizations pursuing ISO 27001 certification frequently make the same mistake: they over-document. Compliance teams write dozens of standalone policy documents — an Access Control Policy, a Cryptography Policy, a Physical Security Policy — each running 10-30 pages. Six months later, they have 500 pages of documentation, a burned-out team, and an auditor asking why half of it isn't implemented.

ISO 27001 doesn't require 500 pages of policies. It requires an Information Security Management System (ISMS) with documented policies, procedures, and controls that are appropriate to your organization's risks and actually implemented.

The distinction matters. The standard cares about substance — clear requirements that people follow — not volume.

What ISO 27001 Actually Mandates

ISO 27001:2022 has specific documentation requirements. Understanding them prevents both over-documentation and gaps.

Mandatory Documents

The standard explicitly requires these documented items:

Annex A Controls

Annex A lists 93 controls across four categories (Organizational, People, Physical, Technological). For each control your risk assessment deems applicable, you need:

1. A documented policy or statement defining the requirement
2. Evidence that the control is implemented
3. Evidence that the control is operating effectively

The key word is "applicable." You don't need all 93 controls. You need the ones your risk assessment identifies, plus a Statement of Applicability (SoA) explaining which controls you selected and why.

The Information Security Policy: Clause 5.2

Clause 5.2 requires top management to establish an information security policy that:

• Is appropriate to the purpose of the organization
• Includes information security objectives or provides a framework for setting them
• Includes a commitment to satisfy applicable requirements
• Includes a commitment to continual improvement of the ISMS

This is deliberately high-level. The top-level Information Security Policy is a strategic document — a page or two stating management's commitment to information security. It's not the place for technical details about password length or encryption algorithms.

The technical details live in supporting policies and statements that flow from this top-level policy. This is where statement-first governance transforms the ISO 27001 experience.

Structuring ISO 27001 Policies as Governance Statements

Instead of writing monolithic policy documents for each Annex A control domain, decompose your requirements into individual governance statements. Each statement maps to one or more Annex A controls and represents a single, auditable requirement.

Example: Access Control (Annex A 5.15-5.18, 8.2-8.5)

Traditional approach: a 15-page Access Control Policy covering everything from user registration to privileged access management.

Statement-first approach:

"Access to information systems must be provisioned based on the principle of least privilege, granting only the minimum permissions required for role function." Maps to: A.5.15, A.8.2

"Privileged access rights must be restricted, logged, and reviewed quarterly by the information security team." Maps to: A.8.2, A.8.18

"User access rights must be reviewed at planned intervals and upon any change of employment status." Maps to: A.5.18

"Authentication credentials must enforce a minimum of 12 characters with complexity requirements, and multi-factor authentication must be enabled for all remote and administrative access." Maps to: A.8.5

Four statements instead of fifteen pages. Each is clear, measurable, and directly mapped to Annex A controls.

Example: Cryptography (Annex A 8.24)

"Data classified as Confidential or Restricted must be encrypted at rest using AES-256 or equivalent, with encryption keys managed through a centralized key management system."

"Data in transit across public networks must be protected using TLS 1.2 or higher."

"Cryptographic key lifecycle — generation, storage, rotation, and destruction — must follow documented procedures reviewed annually."

Three statements. Complete coverage of Annex A 8.24. An auditor can verify each independently.

Building the Statement of Applicability

The Statement of Applicability (SoA) is one of the most important ISO 27001 artifacts. It lists all 93 Annex A controls, states whether each is applicable, provides justification for exclusions, and references the implementing policy or control.

In a document-centric model, the SoA references policy documents: "See Access Control Policy, Section 4.3." The auditor then reads through the section to find the relevant requirement.

In a statement-first model, the SoA references specific governance statements:

The mapping is direct and auditable. No document diving required.

The Annex A Control Families

ISO 27001:2022 organizes its 93 controls into four families. Here's how to approach each with governance statements:

Organizational Controls (A.5) — 37 Controls

These cover information security policies, roles, threat intelligence, asset management, access control, identity management, supplier relationships, and incident management. This family generates the most governance statements — typically 40-60 for a medium-sized organization.

Focus areas: access control, asset management, and incident management produce the most auditor scrutiny.

People Controls (A.6) — 8 Controls

Covering screening, employment terms, awareness, disciplinary process, post-employment responsibilities, NDAs, and remote working. These typically map to HR policies already in place. Write governance statements that formalize existing practice.

Physical Controls (A.7) — 14 Controls

Physical security perimeters, entry controls, office security, monitoring, and equipment protection. Many organizations underinvest here. If you have physical offices or data centers, these statements matter.

Technological Controls (A.8) — 34 Controls

Endpoint devices, privileged access, information access restriction, source code access, authentication, capacity management, malware protection, vulnerability management, logging, network security, and cryptography.

These controls are where technical teams spend most of their effort. Statement-first governance helps by separating the requirement (governance statement) from the implementation (control evidence). The CISO owns the statement; the engineering team owns the implementation.

Practical Tips for ISO 27001 Certification

Don't write policies in isolation. Governance statements should be drafted with input from the teams that will implement them. A password policy that IT didn't help write is a password policy that won't be followed.

Use your risk assessment to prioritize. Not all 93 controls carry equal risk. Your risk assessment tells you where to focus governance effort first.

Version everything. ISO 27001 requires evidence of continual improvement. Statement-level versioning shows auditors exactly how your governance has evolved — which requirements were added, which were strengthened, which were retired.

Connect statements to controls to evidence. The traceability chain is: Governance Statement maps to Annex A Control maps to Implemented Control maps to Evidence. Break any link, and the auditor flags a nonconformity.

Prepare for surveillance audits. Certification is year one. Years two and three bring surveillance audits. Statement-first governance makes ongoing compliance manageable because each statement is continuously tracked — not reviewed once a year in a document refresh.

Leveraging a Governance Library

Writing 50-80 governance statements from scratch is significant effort. A governance library — a curated collection of pre-written, expert-reviewed statements — dramatically accelerates ISO 27001 preparation.

Dictiva's statement library includes governance statements pre-mapped to ISO 27001 Annex A controls. Organizations can adopt statements directly, customize them for their context, and assemble them into the policy documents their ISMS requires.

The result: instead of starting with a blank page and a copy of the standard, you start with a structured set of requirements that your team can review, adapt, and implement. Learn how statement-first governance replaces the document treadmill with a traceable, auditable system — one that auditors appreciate and teams can actually maintain.