12.1.1 An overall information security policy is: • Established. • Published. • Maintained. • Disseminated to all relevant personnel, as well as to relevant vendors and business partners
An overall information security policy is: • Established. • Published. • Maintained. • Disseminated to all relevant personnel, as well as to relevant vendors and business partners.
5
artefacts
1
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Acknowledgement records from personnel and from third parties where applicable · HR system / LMS
periodic reviewEvidence produced at each review
- Evidence of maintenance, such as version control and the record of the last update · Policy repository / GRC workspace
governing documentDocuments that govern the control
- The overall information security policy document, showing it is established and published · Policy repository / GRC workspace
- Dissemination records showing the policy reached all relevant personnel as well as relevant vendors and business partners · Vendor register / contract repository
- Evidence the policy states the strategic objectives and principles of information security · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your HR system / LMS on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Policy published on an internal site with no dissemination to the vendors and business partners the requirement names
- Acknowledgement captured at induction only, so long serving staff have never acknowledged the current version
- Document exists but reads as a control list rather than stating objectives and principles
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet11.6.1 Payment page change and tamper detection · 12.1.2 The information security policy is: • Reviewed at least once every 12 months. • Updated as needed to reflect changes to business objectives or risks to the environment