What is an information security policy?
An information security policy is the document approved by top management in which an organisation states why, what and by whom its information, systems and processes are protected, and which principles, objectives and responsibilities apply. It is often simply called a security policy; ISO 27001 requires it in clause 5.2 as the foundation of every ISMS, and the BIO and the Dutch Cybersecurity Act make it mandatory for many organisations. In OT environments the policy protects not only data but also the availability and safety of industrial processes.
The information security policy is the steering instrument above all technical, organisational and human measures: it states what the organisation wants to achieve and who is responsible, while the procedures beneath it state how.
Note the difference with the occupational safety policy (Dutch veiligheidsbeleid): that covers the physical safety of people and installations under the Dutch Working Conditions Act (Arbowet). The two meet in OT, but they are separate documents with different owners.
🧠 What does an information security policy contain?
A good policy is short and principled; the detail lives in supporting documents. These elements belong in almost every information security policy:
| Element | What you record |
|---|---|
| Purpose and scope | Which business units, sites, systems and processes are covered, explicitly including OT |
| Principles | Availability, integrity and confidentiality (CIA Triad), least privilege, defence in depth, security by design |
| Objectives | Measurable security objectives, or the framework for setting them each year |
| Roles and responsibilities | Board, CISO, Information Security Officer, OSO, line management, system owners, suppliers |
| Risk Management | Method, risk appetite and who may accept residual risk |
| Laws and regulations | Which frameworks apply: NIS2, GDPR (AVG), BIO, sector rules, IEC 62443, and how you demonstrate compliance |
| References to topic-specific policies | Access management and IAM, patch management, backup, incident response, suppliers |
| Awareness | Mandatory awareness training and rules of conduct |
| Enforcement | What happens in case of non-compliance, and how to request an exception |
| Evaluation | Review cycle, audits, reporting to the board and improvement through PDCA |
The board signs the policy. That turns it from an IT document into a board decision to which employees and suppliers can be held.
🔄 How does the policy relate to topic-specific policies and procedures?
Many organisations put everything into one forty-page document that nobody reads. A layered structure works better, as ISO 27002 describes in control 5.1: one overarching information security policy, supplemented by topic-specific policies.
| Level | Example | Approved by | Typical review |
|---|---|---|---|
| Information security policy | Principles, scope, roles, risk appetite | Board or executive management | Annually and after major changes |
| Topic-specific policy | Access policy, cryptography policy, OT remote access policy, backup policy | CISO or security steering group | Annually |
| Standards and baselines | Hardening baseline for engineering workstations, password requirements | Security architect, OT engineering | When threats or versions change |
| Procedures and work instructions | Steps for a PLC firmware update or issuing a USB stick | Department or team | Continuously |
ISO 27002 lists examples of topic-specific policies including access control, physical security, asset management, network security, incident management, backup, cryptography, information classification, technical vulnerability management and secure development. Each topic-specific policy must align with the overarching policy, be approved by management, be communicated to the people it applies to, and be reviewed periodically.
🧱 Which standards and laws require an information security policy?
| Framework | Requirement | Applies to |
|---|---|---|
| ISO 27001:2022, clause 5.2 | Policy appropriate to the organisation’s purpose, with objectives or a framework for them, a commitment to meet requirements and to continual improvement; documented, communicated and available to interested parties | Organisations with a (certified) ISMS |
| ISO 27002:2022, control 5.1 | Overarching and topic-specific policies, approved, published and reviewed periodically | Implementing Annex A |
| NIS2, Article 21(2)(a) | Policies on risk analysis and information system security | Essential and important entities in the EU |
| Cybersecurity Decree, Article 6 | Written security policy with roles, segregation of duties and a PDCA management system, since 15 August 2026 | Entities under the Dutch Cybersecurity Act |
| BIO2 | Measure 5.01 follows ISO 27002 5.1; the policy must explicitly assign responsibility for OT security | Dutch central government, provinces, municipalities, water boards |
| IEC 62443-2-1 | Asset owner security programme with policies and procedures per security program element | Owners and operators of industrial installations |
Under the Dutch Cybersecurity Act, which transposes NIS2, the policy follows directly from the duty of care. The board must approve the measures, oversee their implementation and complete training itself, so an unsigned or outdated policy is a weak point during supervision. ISO 27001 certification is not mandatory, but an ISMS with an approved policy is a common way to demonstrate that you meet the duty of care.
🏭 What should an information security policy cover for OT?
A policy that only describes office IT leaves the largest business risks out of view. For OT the priorities shift:
| OT aspect | What the policy must record |
|---|---|
| Availability before confidentiality | Production and vital processes must not stop because of a security measure; the safety of people and plant comes first |
| Long lifespan | How you handle legacy systems that cannot be patched, through documented compensating measures |
| Segmentation | Zones and conduits according to the Zones and Conduits Model and the Purdue Model, with network segmentation as a mandatory principle |
| Patching and firmware | Who tests and approves updates for PLCs, HMIs and SCADA servers, and in which maintenance window |
| Suppliers | Requirements for suppliers and remote access for maintenance |
| Physical access | Field cabinets, operator panels, control rooms and removable media |
| Monitoring and logging | Which logging and security monitoring apply in the process network, and who follows up alerts from anomaly detection |
| IT and OT roles | Who owns OT security: the CISO, the production manager or a dedicated OT security role |
IEC 62443-2-1 (2024 edition) helps here. The standard asks the asset owner for a security programme with eight elements: organisation, configuration management, network, components, data, user access, events and incidents, and availability. Requirement ORG 1.1 links the programme to an existing ISMS, so you do not need to write a second policy next to your ISO 27001 policy: the OT part becomes a chapter or topic-specific policy under the same roof.
🔧 How do you draw up an information security policy?
A practical approach for an organisation with both IT and OT:
- Define the scope - identify which processes and systems are critical, including OT installations, using a Business Impact Analysis and an up-to-date asset inventory.
- Map your obligations - are you covered by the Cybersecurity Act, the BIO or sector rules? That determines which topics are mandatory.
- Set the risk appetite - together with the board, linked to risk management and a risk assessment of the OT.
- Assign roles - name who owns IT and OT security, who accepts residual risk and who approves exceptions; see also Governance.
- Keep it short - keep the overarching policy compact and move technical detail to topic-specific policies and baselines.
- Approve and communicate - board signature, publication on the intranet, inclusion in onboarding and in supplier contracts.
- Measure and improve - link the policy to KPIs, internal audits and an annual review, and update it after major incidents or reorganisations.
Typical pitfalls are a policy that does not mention OT, a document written by a consultant that nobody knows, missing sanctions, and a policy that has not been reviewed for years. The link with business continuity, contingency planning and the crisis communication plan is also often missing, even though an OT incident quickly becomes a continuity question.
❓ Frequently asked questions
Is a security policy the same as an information security policy?
Yes, in practice security policy and information security policy are used for the same document. ISO 27001 and the Dutch BIO speak of an information security policy, the Dutch Cybersecurity Decree of a security policy. An occupational safety policy about physical safety at work is something different.
Is an information security policy mandatory?
For organisations under the Dutch Cybersecurity Act, a written security policy has been mandatory since 15 August 2026 under Article 6 of the Cybersecurity Decree. Dutch government bodies must have one through the BIO, and for ISO 27001 certification it is a hard requirement of clause 5.2. For other organisations it is not a legal obligation, but it is the basis of any serious security approach.
Who must approve the information security policy?
The information security policy is approved by top management or the board, not by the IT department. ISO 27001 assigns that task to top management, and NIS2 makes management bodies responsible for approving cybersecurity risk-management measures. The CISO usually drafts the policy and monitors its implementation.
How often should you review an information security policy?
You review an information security policy at planned intervals, in practice usually once a year, and also after major changes such as a merger, a new OT network or a serious incident. ISO 27002 asks for review at planned intervals and when significant changes occur. Record every review so that you can demonstrate it during an audit.
Does OT need its own information security policy?
OT does not necessarily need a separate information security policy, but the overarching policy must explicitly include OT in its scope and assign responsibility for it. OT-specific rules, such as those for patching, remote access and segmentation, are best placed in a topic-specific OT policy based on IEC 62443-2-1. For Dutch government bodies, BIO2 even requires the policy to assign responsibility for OT security.
How long should an information security policy be?
A good overarching information security policy is short enough for every employee to read, often just a few pages. Technical details such as password requirements or firewall rules belong in topic-specific policies, standards and procedures. That keeps the policy stable while the technology beneath it changes.
📌 In summary
The information security policy is the board-approved foundation of all security: it records scope, principles, roles and risk appetite for both IT and OT. ISO 27001, NIS2, the BIO and the Dutch Cybersecurity Act make it mandatory for many organisations; with topic-specific policies based on IEC 62443-2-1 it also becomes workable in the production environment.