Information Security Policy: What to Include, Section by Section

Where the requirement comes from

NIS2 lists "policies on risk analysis and information system security" as the first minimum measure (Article 21(2)(a) of Directive (EU) 2022/2555). For digital infrastructure and digital service providers, Implementing Regulation (EU) 2024/2690 sets out in its Annex what the policy must contain. DORA has similar requirements for financial entities (Article 9(4)(a) and Delegated Regulation (EU) 2024/1774). Even if neither applies to you, the 2024/2690 list is the clearest public description of a complete policy.

The eleven elements (Annex, point 1.1.1)

The policy should	Point
Set out your approach to managing the security of your network and information systems	(a)
Fit and complement your business strategy and objectives	(b)
Set security objectives	(c)
Commit to continual improvement	(d)
Commit to providing the resources needed: staff, money, processes, tools and technology	(e)
Be communicated to and acknowledged by relevant employees and relevant external parties	(f)
Lay down roles and responsibilities	(g)
List the documentation to be kept and how long it is retained	(h)
List the topic-specific policies	(i)
Set indicators and measures to monitor implementation and your maturity level	(j)
Show the date of formal approval by the management body	(k)

Roles and reporting lines (point 1.2)

Assign responsibilities and authorities for security to roles, and communicate them to the management body.
Require all personnel and third parties to apply the policy and its procedures.
At least one person reports directly to the management body on security matters.
In small organisations, security can be a duty added to an existing role rather than a dedicated job.
Separate conflicting duties where applicable, for example the person approving access should not be the only one reviewing it.

Topic-specific policies underneath

The main policy stays short and points to topic-specific policies. A typical set, following the areas of the 2024/2690 Annex:

Topic policy	Covers
Acceptable use	What staff may and may not do with company systems and data
Access control and authentication	Least privilege, joiners and leavers, access reviews, multi-factor authentication, passwords
Data classification and handling	Classification levels and how each must be stored, shared and deleted
Cryptography	When data is encrypted at rest and in transit, and key management
Backup and business continuity	Backup scope and frequency, restore testing, continuity plans
Incident response	Detection, escalation, reporting to authorities and customers
Supplier security	Selecting, contracting and monitoring suppliers
Remote work and devices	Laptops, mobile devices, home networks

Draft the basics now: the free Security Policy Generator produces an information security, acceptable use and password policy from your answers.

Keeping it alive

Review and, where appropriate, update the policy at least once a year, and after significant incidents or significant changes to operations or risks; document the review (point 1.1.2).
Have new staff acknowledge it during onboarding, and existing staff after major changes.
Track the indicators you defined, for example MFA coverage, patch times and training completion, and report them to management.
Keep evidence that it is applied: questionnaires and auditors ask for both the policy and proof it works.

The full policy set, ready to adapt. The Security Policy Bundle includes information security, acceptable use, data classification, password and authentication, incident response, remote work and vendor management policies, a business continuity plan template and an implementation checklist.

Information Security Policy: What to Include, Section by Section

Where the requirement comes from

The eleven elements (Annex, point 1.1.1)

Roles and reporting lines (point 1.2)

Topic-specific policies underneath

Keeping it alive

Sources

Related tools

Security Policy Generator

Cybersecurity Maturity Assessment