Annex A.5 - Information Security Policies

Security policy: This control requires organisations to establish an information security policy that reflects their commitment to information security.