{"id":5406,"date":"2022-01-24T08:17:00","date_gmt":"2022-01-24T07:17:00","guid":{"rendered":"http:\/\/dev1.replior.mobi\/?p=5406"},"modified":"2026-04-03T22:48:18","modified_gmt":"2026-04-03T20:48:18","slug":"5-tips-for-writing-an-information-security-policy","status":"publish","type":"post","link":"https:\/\/complior.se\/en\/5-tips-for-writing-an-information-security-policy\/","title":{"rendered":"5 tips for writing an Information Security Policy"},"content":{"rendered":"
\n
\n
<\/svg><\/span>Tillbaka till resurser<\/span><\/a><\/div>\n\n\n\nBlog<\/span>\n\n\n\n

5 tips for writing an Information Security Policy<\/h1>\n\n\n\n
\r\n\t\r\n\t\t<\/rect>\r\n\t\t<\/line>\r\n\t\t<\/line>\r\n\t\t<\/line>\r\n\t<\/svg>\r\n\t\r\n\t\tJan 24, 2022\t<\/span>\r\n<\/div>\n\n\n

<\/svg><\/span>2 min <\/span><\/h1><\/div>\n<\/div>\n\n\n\n
\"man<\/figure>\n<\/div><\/div>\n\n\n\n
\n
\n

The role of policies in GDPR<\/h2>\n\n\n\n

One thing that is mentioned a lot when it comes to GDPR is policies. A large part of how companies demonstrate compliance with GDPR is through documentation and policies. The regulation, for example, requires a data protection and information security policy to exist, as well as a privacy policy.<\/p>\n\n\n\n

A data protection and information security policy is a document that describes the organisation and its overall routines and processes in relation to the handling and processing of personal data. <\/p>\n\n\n\n

It can be time consuming to create a policy, and there are a few important things to keep in mind when developing an information security policy.<\/p>\n<\/div>\n\n\n\n

\n

What an information security policy should include<\/h2>\n\n\n\n

As of now, there isn\u2019t a specific template to follow when writing a GDPR information security policy. Our advice is therefore to base it on the ISO 27001 standard and adjust the policy to the requirements prioritised in GDPR.<\/p>\n\n\n\n

The document should include a general description of the policy, scope, stakeholders and their requirements. It should also include the following:<\/p>\n\n\n\n

\n

Core components of the policy<\/h3>\n\n\n\n
    \n
  • Organisation (stakeholders, scope)<\/li>\n\n\n\n
  • Leadership (management structure, policy, responsibility)<\/li>\n\n\n\n
  • Planning (risks\/opportunities, goals)<\/li>\n\n\n\n
  • Support (resources, competence, awareness, documentation)<\/li>\n\n\n\n
  • Activities (planning, assessment and handling of risks)<\/li>\n\n\n\n
  • Evaluation of performance (measurement, analysis, evaluation, audit)<\/li>\n\n\n\n
  • Improvements (and deviations)<\/li>\n<\/ul>\n<\/div>\n<\/div>\n\n\n\n
    \n

    GDPR-specific considerations<\/h2>\n\n\n\n

    To adapt the policy to GDPR, it is important to document and specify areas prioritised in the regulation. These include access control, Security by Design, assets such as records of data processing activities, and incident handling, since GDPR requires quick reporting of incidents.<\/p>\n<\/div>\n\n\n\n

    \n

    5 quick tips for writing an information security policy<\/h2>\n\n\n\n
    \n

    Use clear and familiar language<\/h3>\n\n\n\n

    Decide which language to use, everyone should be able to understand the content of the policy. Use terms and language already familiar within the organisation.<\/p>\n<\/div>\n\n\n\n

    \n

    Involve the entire organisation<\/h3>\n\n\n\n

    Involve people across the organisation before, during and after writing the policy. Even though it is mainly a management document, broad involvement is important. Continuous internal training is also key.<\/p>\n<\/div>\n\n\n\n

    \n

    Reuse existing policies<\/h3>\n\n\n\n

    If you already have policies in place, reuse what works. Some parts of older policies may still be highly effective.<\/p>\n<\/div>\n\n\n\n

    \n

    Keep it simple<\/h3>\n\n\n\n

    At the policy level, focus on being broad and strategic. Avoid unnecessary detail and instead emphasise purpose and goals.<\/p>\n<\/div>\n\n\n\n

    \n

    Treat the policy as a living document<\/h3>\n\n\n\n

    Don\u2019t be afraid to change a policy. It should be continuously updated to stay relevant and effective.<\/p>\n<\/div>\n<\/div>\n<\/div><\/div>","protected":false},"excerpt":{"rendered":"

    5 tips for writing an Information Security Policy: It can be time consuming to create a policy. And there are a few things to keep in mind<\/p>","protected":false},"author":2,"featured_media":73512,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"blogg","format":"standard","meta":{"_editorskit_title_hidden":false,"_editorskit_reading_time":2,"_editorskit_is_block_options_detached":false,"_editorskit_block_options_position":"{}","_eb_attr":"","inline_featured_image":false,"_uag_custom_page_level_css":"","wpm_timeformat":"","_wpm_styles":"","footnotes":""},"categories":[118],"tags":[117,146,141],"class_list":["post-5406","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogg","tag-blog","tag-information-security","tag-policy"],"yoast_head":"\n5 tips for writing an Information Security Policy - Complior<\/title>\n<meta name=\"description\" content=\"5 tips for writing an Information Security Policy: It can be time consuming to create a policy. And there are a few things to keep in mind\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/complior.se\/en\/5-tips-for-writing-an-information-security-policy\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"5 tips for writing an Information Security Policy - Complior\" \/>\n<meta property=\"og:description\" content=\"5 tips for writing an Information Security Policy: It can be time consuming to create a policy. And there are a few things to keep in mind\" \/>\n<meta property=\"og:url\" content=\"https:\/\/complior.se\/en\/5-tips-for-writing-an-information-security-policy\/\" \/>\n<meta property=\"og:site_name\" content=\"Complior\" \/>\n<meta property=\"article:published_time\" content=\"2022-01-24T07:17:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-03T20:48:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/complior.se\/wp-content\/uploads\/2021\/10\/5-tips-02-scaled.png\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1340\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Kikki Bostrom\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kikki Bostrom\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/complior.se\\\/5-tips-for-writing-an-information-security-policy\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/complior.se\\\/5-tips-for-writing-an-information-security-policy\\\/\"},\"author\":{\"name\":\"Kikki Bostrom\",\"@id\":\"https:\\\/\\\/complior.se\\\/#\\\/schema\\\/person\\\/841f8a57425589a6d7f13c201d345016\"},\"headline\":\"5 tips for writing an Information Security Policy\",\"datePublished\":\"2022-01-24T07:17:00+00:00\",\"dateModified\":\"2026-04-03T20:48:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/complior.se\\\/5-tips-for-writing-an-information-security-policy\\\/\"},\"wordCount\":422,\"publisher\":{\"@id\":\"https:\\\/\\\/complior.se\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/complior.se\\\/5-tips-for-writing-an-information-security-policy\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/complior.se\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/5-tips-02-scaled.png\",\"keywords\":[\"Blog\",\"Information security\",\"Policy\"],\"articleSection\":[\"Blogg\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/complior.se\\\/5-tips-for-writing-an-information-security-policy\\\/\",\"url\":\"https:\\\/\\\/complior.se\\\/5-tips-for-writing-an-information-security-policy\\\/\",\"name\":\"5 tips for writing an Information Security Policy - Complior\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/complior.se\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/complior.se\\\/5-tips-for-writing-an-information-security-policy\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/complior.se\\\/5-tips-for-writing-an-information-security-policy\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/complior.se\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/5-tips-02-scaled.png\",\"datePublished\":\"2022-01-24T07:17:00+00:00\",\"dateModified\":\"2026-04-03T20:48:18+00:00\",\"description\":\"5 tips for writing an Information Security Policy: It can be time consuming to create a policy. And there are a few things to keep in mind\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/complior.se\\\/5-tips-for-writing-an-information-security-policy\\\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/complior.se\\\/5-tips-for-writing-an-information-security-policy\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/complior.se\\\/5-tips-for-writing-an-information-security-policy\\\/#primaryimage\",\"url\":\"https:\\\/\\\/complior.se\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/5-tips-02-scaled.png\",\"contentUrl\":\"https:\\\/\\\/complior.se\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/5-tips-02-scaled.png\",\"width\":2560,\"height\":1340,\"caption\":\"man holding a lightbulb as he has gotten an idea\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/complior.se\\\/5-tips-for-writing-an-information-security-policy\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/complior.se\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"5 tips for writing an Information Security Policy\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/complior.se\\\/#website\",\"url\":\"https:\\\/\\\/complior.se\\\/\",\"name\":\"Complior\",\"description\":\"Security beyond compliance\",\"publisher\":{\"@id\":\"https:\\\/\\\/complior.se\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/complior.se\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/complior.se\\\/#organization\",\"name\":\"Complior\",\"url\":\"https:\\\/\\\/complior.se\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/complior.se\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/complior.se\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/Complior_logo_dark-scaled.png\",\"contentUrl\":\"https:\\\/\\\/complior.se\\\/wp-content\\\/uploads\\\/2025\\\/06\\\/Complior_logo_dark-scaled.png\",\"width\":2560,\"height\":960,\"caption\":\"Complior\"},\"image\":{\"@id\":\"https:\\\/\\\/complior.se\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/complior.se\\\/#\\\/schema\\\/person\\\/841f8a57425589a6d7f13c201d345016\",\"name\":\"Kikki Bostrom\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3a78a33b10cfcbf5a04f53b522f24d176544c6ab014b5174854b6bb92287e13?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3a78a33b10cfcbf5a04f53b522f24d176544c6ab014b5174854b6bb92287e13?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3a78a33b10cfcbf5a04f53b522f24d176544c6ab014b5174854b6bb92287e13?s=96&d=mm&r=g\",\"caption\":\"Kikki Bostrom\"},\"url\":\"https:\\\/\\\/complior.se\\\/en\\\/author\\\/kikki\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"5 tips for writing an Information Security Policy - Complior","description":"5 tips for writing an Information Security Policy: It can be time consuming to create a policy. And there are a few things to keep in mind","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/complior.se\/en\/5-tips-for-writing-an-information-security-policy\/","og_locale":"en_GB","og_type":"article","og_title":"5 tips for writing an Information Security Policy - Complior","og_description":"5 tips for writing an Information Security Policy: It can be time consuming to create a policy. And there are a few things to keep in mind","og_url":"https:\/\/complior.se\/en\/5-tips-for-writing-an-information-security-policy\/","og_site_name":"Complior","article_published_time":"2022-01-24T07:17:00+00:00","article_modified_time":"2026-04-03T20:48:18+00:00","og_image":[{"width":2560,"height":1340,"url":"https:\/\/complior.se\/wp-content\/uploads\/2021\/10\/5-tips-02-scaled.png","type":"image\/png"}],"author":"Kikki Bostrom","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Kikki Bostrom","Estimated reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/complior.se\/5-tips-for-writing-an-information-security-policy\/#article","isPartOf":{"@id":"https:\/\/complior.se\/5-tips-for-writing-an-information-security-policy\/"},"author":{"name":"Kikki Bostrom","@id":"https:\/\/complior.se\/#\/schema\/person\/841f8a57425589a6d7f13c201d345016"},"headline":"5 tips for writing an Information Security Policy","datePublished":"2022-01-24T07:17:00+00:00","dateModified":"2026-04-03T20:48:18+00:00","mainEntityOfPage":{"@id":"https:\/\/complior.se\/5-tips-for-writing-an-information-security-policy\/"},"wordCount":422,"publisher":{"@id":"https:\/\/complior.se\/#organization"},"image":{"@id":"https:\/\/complior.se\/5-tips-for-writing-an-information-security-policy\/#primaryimage"},"thumbnailUrl":"https:\/\/complior.se\/wp-content\/uploads\/2021\/10\/5-tips-02-scaled.png","keywords":["Blog","Information security","Policy"],"articleSection":["Blogg"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/complior.se\/5-tips-for-writing-an-information-security-policy\/","url":"https:\/\/complior.se\/5-tips-for-writing-an-information-security-policy\/","name":"5 tips for writing an Information Security Policy - Complior","isPartOf":{"@id":"https:\/\/complior.se\/#website"},"primaryImageOfPage":{"@id":"https:\/\/complior.se\/5-tips-for-writing-an-information-security-policy\/#primaryimage"},"image":{"@id":"https:\/\/complior.se\/5-tips-for-writing-an-information-security-policy\/#primaryimage"},"thumbnailUrl":"https:\/\/complior.se\/wp-content\/uploads\/2021\/10\/5-tips-02-scaled.png","datePublished":"2022-01-24T07:17:00+00:00","dateModified":"2026-04-03T20:48:18+00:00","description":"5 tips for writing an Information Security Policy: It can be time consuming to create a policy. And there are a few things to keep in mind","breadcrumb":{"@id":"https:\/\/complior.se\/5-tips-for-writing-an-information-security-policy\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/complior.se\/5-tips-for-writing-an-information-security-policy\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/complior.se\/5-tips-for-writing-an-information-security-policy\/#primaryimage","url":"https:\/\/complior.se\/wp-content\/uploads\/2021\/10\/5-tips-02-scaled.png","contentUrl":"https:\/\/complior.se\/wp-content\/uploads\/2021\/10\/5-tips-02-scaled.png","width":2560,"height":1340,"caption":"man holding a lightbulb as he has gotten an idea"},{"@type":"BreadcrumbList","@id":"https:\/\/complior.se\/5-tips-for-writing-an-information-security-policy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/complior.se\/"},{"@type":"ListItem","position":2,"name":"5 tips for writing an Information Security Policy"}]},{"@type":"WebSite","@id":"https:\/\/complior.se\/#website","url":"https:\/\/complior.se\/","name":"Complior","description":"Security beyond compliance","publisher":{"@id":"https:\/\/complior.se\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/complior.se\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/complior.se\/#organization","name":"Complior","url":"https:\/\/complior.se\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/complior.se\/#\/schema\/logo\/image\/","url":"https:\/\/complior.se\/wp-content\/uploads\/2025\/06\/Complior_logo_dark-scaled.png","contentUrl":"https:\/\/complior.se\/wp-content\/uploads\/2025\/06\/Complior_logo_dark-scaled.png","width":2560,"height":960,"caption":"Complior"},"image":{"@id":"https:\/\/complior.se\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/complior.se\/#\/schema\/person\/841f8a57425589a6d7f13c201d345016","name":"Kikki Bostrom","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/secure.gravatar.com\/avatar\/d3a78a33b10cfcbf5a04f53b522f24d176544c6ab014b5174854b6bb92287e13?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d3a78a33b10cfcbf5a04f53b522f24d176544c6ab014b5174854b6bb92287e13?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d3a78a33b10cfcbf5a04f53b522f24d176544c6ab014b5174854b6bb92287e13?s=96&d=mm&r=g","caption":"Kikki Bostrom"},"url":"https:\/\/complior.se\/en\/author\/kikki\/"}]}},"uagb_featured_image_src":{"full":["https:\/\/complior.se\/wp-content\/uploads\/2021\/10\/5-tips-02-scaled.png",2560,1340,false],"thumbnail":["https:\/\/complior.se\/wp-content\/uploads\/2021\/10\/5-tips-02-150x150.png",150,150,true],"medium":["https:\/\/complior.se\/wp-content\/uploads\/2021\/10\/5-tips-02-300x157.png",300,157,true],"medium_large":["https:\/\/complior.se\/wp-content\/uploads\/2021\/10\/5-tips-02-768x402.png",768,402,true],"large":["https:\/\/complior.se\/wp-content\/uploads\/2021\/10\/5-tips-02-1024x536.png",1024,536,true],"1536x1536":["https:\/\/complior.se\/wp-content\/uploads\/2021\/10\/5-tips-02-1536x804.png",1536,804,true],"2048x2048":["https:\/\/complior.se\/wp-content\/uploads\/2021\/10\/5-tips-02-2048x1072.png",2048,1072,true],"trp-custom-language-flag":["https:\/\/complior.se\/wp-content\/uploads\/2021\/10\/5-tips-02-18x9.png",18,9,true]},"uagb_author_info":{"display_name":"Kikki Bostrom","author_link":"https:\/\/complior.se\/en\/author\/kikki\/"},"uagb_comment_info":0,"uagb_excerpt":"5 tips for writing an Information Security Policy: It can be time consuming to create a policy. And there are a few things to keep in mind","_links":{"self":[{"href":"https:\/\/complior.se\/en\/wp-json\/wp\/v2\/posts\/5406","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/complior.se\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/complior.se\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/complior.se\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/complior.se\/en\/wp-json\/wp\/v2\/comments?post=5406"}],"version-history":[{"count":5,"href":"https:\/\/complior.se\/en\/wp-json\/wp\/v2\/posts\/5406\/revisions"}],"predecessor-version":[{"id":80289,"href":"https:\/\/complior.se\/en\/wp-json\/wp\/v2\/posts\/5406\/revisions\/80289"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/complior.se\/en\/wp-json\/wp\/v2\/media\/73512"}],"wp:attachment":[{"href":"https:\/\/complior.se\/en\/wp-json\/wp\/v2\/media?parent=5406"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/complior.se\/en\/wp-json\/wp\/v2\/categories?post=5406"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/complior.se\/en\/wp-json\/wp\/v2\/tags?post=5406"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}