I'm going through my first ISO27001 implementation and I can't seem to find a definitive list of what policies are required. I realise Annex A is "optional".

I've found lists online a few times on a few different sites. I've dumped it into a table and grabbed the descriptions and headings from the actual ISO27001/27002 documentation for the individual controls highlighting any literal policy reference I can find.

enter image description here

The only odd one out I can't find in the official documentation is A.8.1.3 Acceptable Use of Information Assets.

I've always been lead to believe an AUP is a mandatory document and a lot of sites online seem to agree with this.

Is it not under ISO or am I missing something? I've not had formal ISO training but I do have my CISSP so I understand the controls, but I'm only starting to get my head round 27001.

  • I'm confused about what you are asking. You say that AUP is not mandatory, but it's on the list? I think you are missing some context for what that list is and how it relates to your question.
    – schroeder
    Jul 23, 2021 at 12:19
  • Are you asking about the difference between "rules" and "policies"?
    – schroeder
    Jul 23, 2021 at 12:20
  • Apologies yes I'm missing some context, sorry! The list I've grabbed from the above keeps coming up as "mandatory policies" online, so I've dumped it into a table and grabbed all the references I can find. The only one on the online list that I can't find a policy reference for is the AUP. Sorry!
    – mak47
    Jul 23, 2021 at 12:24
  • Do you have access to the actual ISO 27001 document? Or are you only working from secondary lists? And it looks like AUP is on the list, as you highloghted. I'm confused about what you are asking or what your confusion is.
    – schroeder
    Jul 23, 2021 at 12:25
  • 1
    Ok, I keep asking the same question over and over. You say that an AUP isn't mentioned, but there it is in the list you posted and in A.8.1.3. Explain like I'm 5: what are you expecting to see and how is what you are seeing not that?
    – schroeder
    Jul 23, 2021 at 14:12

1 Answer 1


I think your issue can be summed up with a misunderstanding of the term "policy". Many people use the term "policy" to mean many things:

  • strategy
  • guidance
  • direction
  • procedures
  • mandates
  • technical specifications

But these are all different types of documents. ISO 27000 defines "policy" specifically:

intentions and direction of an organization (3.50), as formally expressed by its top management (3.75)

For A.8.1.3, they are not looking for a "policy" (i.e. intentions and directions). They are looking for "rules" (i.e. "do this").

So, while people generally call the document an "Acceptable Use Policy" (AUP), it's not a policy as defined by ISO 27000. It's a set of rules users are meant to follow without deviation.

And, as you can see in the list you posted, it's there.

  • I'd also refer to ISO 27002 sections 5.1.1 and 8.1.3, which explicitly call for defined, approved, published, and communicated policies (5.1.1) and rules being defined for the acceptable use of information and assets being identified, documented, and implemented (8.1.3). Jul 23, 2021 at 14:26
  • 1
    All that detail is provided by the OP. That's already known ...
    – schroeder
    Jul 23, 2021 at 14:39
  • That does clear that up yes. Historically I've taken policy as a much narrower definition. To me a policy is not a strategy, guidance, direction, procedures, mandates, technical, specifications. It might include those sure, almost all of them but it's not individually them. The ISO definition seems different from how I've been working with it for the last few years. Thank you @schroeder
    – mak47
    Jul 26, 2021 at 16:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .