ISO27001 - Control 5.1 - Policies for Information Security Control Information security policy and topic-specific policies should be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur. What this means This control is all about the importance of having robust security information policies in place and reviewing them regularly. Information security policies provide the foundation for managing risks and protecting information assets and there are certain policies required by [...]