FREE TEMPLATE · WORD TEMPLATE
Information security policy
An editable top-level information security policy for organisations preparing for NIS2, CyFun, the Cyberbeveiligingswet or ISO/IEC 27001. It sets direction, roles and principles, and links to topic-specific policies for each NIS2 Article 21 measure.
What's inside
- Policy statement and objectives ready for management body approval
- Roles and responsibilities, including the NIS2 duties of the management body
- Principles for each NIS2 Article 21(2) measure, from risk analysis to MFA
- Incident reporting commitments (24 hours, 72 hours, one month)
- Register of topic-specific policies with owners and review dates
- Approval, exceptions and review section
Sections
1. Purpose2. Scope3. Policy statement and objectives4. Roles and responsibilities5. Security principles6. Incident reporting7. Compliance and exceptions8. Register of topic-specific policies9. Review and approval
How to use it
- Replace the placeholders in [square brackets] with your own details
- Remove principles that do not apply and align the wording with your risk assessment
- Link each principle to the topic-specific policy that details it
- Have the management body approve the policy and record the decision
- Review the policy at least annually and after significant changes
Related guide
Same house style as every Secrato template: a start sheet with instructions, light blue cells to fill in, and version control. Free to use within your organisation. This template is practical guidance, not legal advice.
Get the template
Enter your work e-mail and we will send you a personal download link straight away. We may follow up with related guidance; you can opt out at any time.
