# Information Security Policy

> Mandatory – ISO/IEC 27001:2022 cl.5.2. The top-level ISMS document:
> sets direction, approved by top management, communicated to staff
> and available to interested parties as appropriate.

| Field | Value |
|-------|-------|
| Document ID | DOC-ISMS-001 |
| Version | N.N |
| Approved by | Top management |
| Effective | YYYY-MM-DD |
| Next review | YYYY-MM-DD |

## 1. Purpose

Establish management's commitment to protecting the confidentiality,
integrity, and availability (CIA) of information.

## 2. Scope

All information assets within the ISMS scope (DOC-ISMS-000):
information in any form, systems, people, processes, facilities.

## 3. Policy statements

### 3.1 Core commitments

1. Information is protected against unauthorized access (C),
   unauthorized modification (I), and loss of availability (A).
2. Security risk is assessed and treated per the risk methodology
   (DOC-ISMS-010).
3. Security objectives are set, measured, and reviewed (cl.6.2).
4. All legal, regulatory, and contractual requirements are met
   (register: DOC-ISMS-014).
5. All staff receive security awareness training; violations lead to
   disciplinary action.
6. Incidents are reported, managed, and learned from (DOC-ISMS-020).

### 3.2 Roles

| Role | Accountability |
|------|----------------|
| Top management | ISMS effectiveness, resources, approval |
| ISMS manager / CISO | day-to-day ISMS operation |
| All staff | comply with policies, report incidents |

## 4. Supporting documents

Subordinate policies implementing this one:

| Doc ID | Topic |
|--------|-------|
| POL-AUP-001 | Acceptable use |
| POL-ACC-002 | Access control |
| POL-INC-003 | Incident response |
| POL-BCP-004 | Business continuity |

## 5. Non-compliance

Consequences of violating this policy.

## 6. Approval & review

Approved by top management; reviewed annually and after significant
change.