IT securitypolicy as atemplate.

Replace every placeholder in square brackets, delete anything that does not apply, and derive the objectives from your business objectives and your risk analysis. The eight sections cover all rows of the table in Section 2; NIS2 entities should not delete anything there without review.

1. 1

   Purpose and scope

   This policy defines why and how [Company] protects information. It applies to [the entire company | sites, divisions], to management, managers, and all employees, to external persons working for [Company], and to information in any form: on paper, in IT systems, in cloud services, and on mobile devices.

2. 2

   Importance and security objectives

   Our most important business processes are [e.g., order processing, production]; they depend on [e.g., ERP system, email]. An outage or leak of this information endangers [e.g., ability to deliver, customer trust]. We therefore protect confidentiality, integrity, and availability as appropriate to the risk. Our objectives: [e.g., customer data is accessible only to authorized persons; order processing is running again within [hours] after an outage; legal and contractual obligations are met].

3. 3

   Responsibility of management

   Management bears overall responsibility for information security. It approves this policy, enforces it, leads by example in following the rules, and provides staff, budget, procedures, and technology. It receives reports on status, risks, and incidents at least [every six months] and decides how to handle residual risks.

4. 4

   Roles and organization

   The information security officer is [name, function], deputy [name, function]. The information security officer coordinates information security, advises management, reports directly to it, and is involved early in major projects and new IT systems. Further roles are listed in the table below; management reviews them [annually] and after significant incidents or changes.

5. 5

   Policies and training

   The security concept defines the measures based on a risk analysis. Individual topics are governed by separate policies consistent with this policy: [e.g., basic rules (Part B), access control, backup, security incidents, suppliers], approved by [function]. All employees are briefed before their first IT use and trained at least [annually]; management receives training designed specifically for it.

6. 6

   Violations and exceptions

   Violations can harm [Company], customers, and partners; employees are informed of possible consequences. [Function] decides case by case how a violation is handled, in accordance with the employment contract, [works agreement], and applicable law. Exceptions to rules are permitted only with justification, for a limited time, and after approval by [function]; [information security officer] keeps an overview of them.

7. 7

   Review, metrics, and documentation

   We continuously improve information security. Management reviews this policy at least [annually] and after significant incidents or significant changes, and documents the result. We measure progress by [metrics, e.g., training rate, time to install critical updates]. [information security officer] retains [documents, e.g., risk analysis, reports, training records, incident logs] for [period].

8. 8

   Entry into force

   Management approved this policy on [MM/DD/YYYY]. It enters into force on [MM/DD/YYYY], replaces [previous version | none], and is communicated to all employees and the affected external partners, who confirm that they have read it. Next review no later than [MM/DD/YYYY].

References for the model text: Section 3 based on ISMS.1.A1 and ISMS.1.A12. Section 4 based on ISMS.1.A4, ISMS.1.A6, and Annex point 1.2 IR 2024/2690. Section 5 based on ISMS.1.A7 and ORP.3.A3. Section 6 based on ISMS.1.A8 and ORP.5.A5. Section 7 based on ISMS.1.A11, ISMS.1.A13, and Annex points 1.1.1(d), (h), (j), and 1.1.2. Section 8 based on BSI Standard 200-2, chapter 3.4.4, and Annex point 1.1.1(f), (k).