- Meaning
- Binding company rules
- Examples
- Password, access and backup policies
- Relation
- A core component of every ISMS
- Benefit
- Clarity and provability
- Updated
- June 2026
- Editorial team
- Compliance Compass
What are security policies?
Security policies lay down in binding form how security is to be handled in the organisation – rules for passwords, access, mobile devices or backups, for example. They translate abstract security objectives into clear, enforceable requirements for everyday work. While Governance decides which objectives apply, policies describe concretely how they are to be met in day-to-day business. They are therefore the written link between a leadership decision and lived practice and, together with the technical Controls , they form the foundation of a working security management.
Typical policies
- Password and access policy
- Policy for mobile working and BYOD
- Backup and data protection policy
- Handling incidents and reporting routes
Lived, not filed away
A policy only works if it is known, understandable, current and enforced – a document that is filed away protects nobody. That is why Security awareness training, clear ownership for keeping it current and regular updating are inseparable from it. An example: After a phishing incident an online retailer finds that a password policy exists but nobody knows it. Only the combination of a revised policy, mandatory training and technically enforced MFA makes the requirement effective and provable in an audit.
Security policies and NIS2
Policies are a core component of an ISMS and a direct expression of governance. They make security requirements traceable and checkable – and so they supply central evidence for NIS2 compliance. Because NIS2 requires documented technical and organisational measures, current, enforced policies are often the first thing a competent authority or an auditor looks at. Missing or outdated policies are therefore a concrete compliance risk that can lead as far as fines. An example: An energy company in scope can evidence its NIS2 measures in an inspection above all when every policy carries an approval date, a responsible owner and a record of the last review; a rule agreed only verbally counts in an audit as undocumented and therefore as unmet.
Further reading: BSI – IT-Grundschutz (German standard)
Frequently asked questions
What are security policies in IT security?
Security policies are binding company rules that set out how security, access, processes and responsibilities are to be handled. A policy translates abstract security objectives into concrete, checkable requirements for the everyday work of all staff. Typical examples are password, access and backup policies. Policies are a core component of every information security management system (ISMS) and the written link between a leadership decision and lived practice.
Why do security policies matter for NIS2?
Policies make security requirements traceable and supply documented evidence for NIS2 compliance. Because NIS2 requires documented technical and organisational measures, current policies show an authority or an auditor that the measures are laid down in binding form. Missing or outdated policies are a compliance risk: Article 34 sets minimum fine ceilings of EUR 10 million or 2 % of total worldwide annual turnover for essential entities, and Member States may set higher amounts.
What makes a policy effective?
A policy only works if it is known, understandable, current and enforced – a document that is merely filed away protects nobody. That means regular awareness training, clear ownership for keeping the policy current, and a recurring review and update of its content. Every policy should carry an approval date, a responsible owner and a record of the last review, because a rule agreed only verbally counts as undocumented in an audit.