Templates / Attestation Flow

Information security policy (ISO 27001) template

A top level information security policy written in the shape ISO/IEC 27001 clause 5.2 expects, covering commitments, responsibilities and roles. Everyone with access, contractors included, reads it for at least two minutes, answers two quiz questions and re-attests yearly.

• App: Attestation Flow for Confluence
• Category: Security
• Edition: Picking the pack works in every edition; the paid settings and the starter text need a paid licence
• Re-acknowledge: every 365 days

Note shown to readers:

By acknowledging, you confirm you have read the information security policy, understand your responsibilities and will report security incidents without delay.

Template. This template is a starting point, not legal advice. Adapt it to your organisation, your contracts and the law that applies to you, and have it reviewed by a qualified professional before you rely on it.

Purpose

[Company] protects the confidentiality, integrity and availability of the information it holds for customers, employees and partners. This policy sets the direction and the commitment of management for the information security management system (ISMS).

Scope

This policy applies to all employees, contractors and third parties who access [Company] information or systems, in every location and on every device.

Our commitments

• Meet legal, regulatory and contractual security requirements.
• Assess information security risks at least once a year and treat them to an acceptable level.
• Set measurable security objectives and review them in management review.
• Give everyone the training they need to work securely.
• Continually improve the ISMS.

Your responsibilities

• Follow the supporting policies: acceptable use, access control, passwords, clean desk and incident response.
• Protect information according to its classification.
• Report suspected incidents and weaknesses to [security contact] immediately.

Roles

[Role, for example Information Security Officer] owns this policy and the ISMS. Top management approves it and provides the resources it needs. Line managers make sure their teams follow it.

Review

This policy is reviewed at least once a year and after any significant change. Approved by [name, role] on [date].

Includes 2 quiz questions; the answers are not published here. They are shown only in the app's requirement editor, to the person setting up the requirement, who can change them before saving.

1. Who must follow this policy?
   • Only the IT team
   • Everyone who uses [Company] information or systems, including contractors
   • Only managers
2. What do you do when you suspect a security incident?
   • Wait to see if it happens again
   • Report it to [security contact] straight away
   • Fix it yourself and tell nobody

Edit a Confluence page, insert the Attestation Flow macro, open the requirement editor and pick the pack under Start from a policy pack. It fills the note and the due date; with a paid licence it also fills the re-acknowledgement window, the minimum reading time and the quiz, and can add the starter text to the page. Required readers are never preset: you choose them.

• Attestation Flow for Confluence documentation
• Confluence policy templates: all 16 templates