Why ISO 27001 is policy-heavy
ISO 27001 is a management system standard, not a technical checklist. Auditors do not care how clever your firewall is — they care that you decided how it should be configured, wrote it down, communicated it, reviewed it and proved you followed it. Documented policies are the connective tissue.
If you are early in your certification journey, the 14 policies below are the bedrock. Skipping any of them is the fastest way to a non-conformity.
The 14 mandatory policies
- Information security policy — the top-level document signed by your CEO that states the organisation's commitment.
- Acceptable use policy — what employees can and cannot do with company systems.
- Access control policy — how identities are granted, reviewed and revoked.
- Password policy — length, rotation, MFA, manager use.
- Cryptography policy — algorithms, key management, when to encrypt.
- Backup policy — frequency, retention, restore testing.
- Antivirus / endpoint protection policy — what runs on every laptop and server.
- Change management policy — how you ship changes safely.
- Incident response policy — detection, triage, communication, lessons learned.
- Business continuity policy — what happens if a region goes down.
- Data classification & handling policy — public / internal / confidential / restricted.
- Supplier security policy — DPAs, security questionnaires, audits.
- Remote work policy — laptops, VPN, family computer rules.
- Acceptable encryption & remote access policy — VPN, SSH, IPsec, TLS.
What auditors actually check
For each policy, the auditor will ask three questions:
- Approval: who approved it, when, on what version?
- Communication: how did employees learn about it (induction email, intranet, signed acknowledgement)?
- Review: when was it last reviewed (annually, or after a major change)?
If you cannot answer all three, the policy fails — even if its content is perfect.
How PolicyForge accelerates this
Every PolicyForge template is mapped to a specific ISO 27001 control, comes in English and French, and includes an approval block, communication notes and a review date field. You generate the 14 policies in under 30 minutes and walk into your audit with the documentation already in shape.