I'm new to ISO 27001 and my goal is to come up with an ISMS policy for an mid-size organisation. As I did not purchase the standards, I went to read up advisera's articles and went through their free foundation video course.
Now, I'm this confused state of trying to understand how to structure the contents and the documents for ISMS, and the granularity of the content.
I found 3 references online(link below) which I think it's pretty decent. However, the granularity of these documents are very different from one another.
https://www.gs.unsw.edu.au/policy/documents/itsecuritypolicy.pdf
Separate into multiple documents. Section 2, high level description of control implemented from Annex A I believe. It then reference to very detail documents of how the control is enforced. Eg. https://www.gs.unsw.edu.au/policy/documents/ITSS_15.pdf
Do I need to provide this document(ITSS_15.pdf) with such granularity to get certified?http://openaccess.uoc.edu/webapps/o2/bitstream/10609/59325/8/prodalTFM1216mem%C3%B2ria.pdf
All in one document. Annex 1 talks about the annex A controls I believe, not as detailed as the detailed document referenced on section 2 of link 1.
http://www.easypqq.co.uk/wp-content/uploads/2016/04/ISMS-Policy.pdf
All in one document. I think that section 6 talks about annex A control, very high level
As you can see the 3 documents above, their granularity and structure of the contents are very different. How to structure the contents and the documents for ISMS, and the granularity of the content?