Habit 02 of 18
Governance
A written security policy
A short document says how you protect information, and staff have read it.
A written policy turns habits into rules everyone can see. Most questionnaires ask for one first.
Switch it on in the map Counts towards 3 articles, controls and categories
§1 How to do it
How a small firm does it
- Write two or three pages, not twenty. Cover passwords and sign-in, devices, data handling, and what to do if something goes wrong.
- Have the owners approve it and date it.
- Ask every staff member to read it and confirm, including new joiners.
- Review it once a year, or when something big changes.
Evidence that shows it
- The policy, with a version number, approval date and next review date
- A record that staff have read it
Ireland: NCSC Ireland guidance on policies and procedures applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 1 item
-
21(2)(a) Risk analysis and security policies · subset
policies on risk analysis and information system security
A written security policy is the information system security half of this measure.
Read Art 21(2)(a) on EUR-Lex
ISO/IEC 27001:2022 1 item
-
A.5.1 Security policies · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
A short security policy that is approved and shared with staff is what this control is about.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 1 item
-
GV.PO Policy · subset
GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
A written policy that staff have read covers “established” and “communicated”. Enforcing and reviewing it are the rest of this category.
Read GV.PO-01 on NIST
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.