ISSP & security documentation IT security policy: a tailored ISSP adapted to your business

ISSP stands for Information Systems Security Policy. It is the usual name for the framework document of an organisation's IT security policy. See the definition →

The ISSP is the framework document that defines the security rules applicable to an organisation's information system. It turns security objectives into concrete rules: responsibilities, access, tool usage, data protection, incident management, backups, providers and continuity. See what an ISSP is →

It formalises security rules, responsibilities and requirements: who decides, which practices are expected, how to react to an incident and how to check. It aligns leadership, IT, business teams and providers on a shared framework that can be applied day to day — not a theoretical document left in a folder. See what makes an ISSP workable →

An ISSP typically covers governance and responsibilities, access management, endpoint and device security, networks and infrastructure, backups, incident management, provider security, remote work and mobility, business continuity, and control. The exact content is calibrated to the IT landscape, the risks, the business and the applicable requirements. Operational policies and procedures (charter, access, incidents, backup, etc.) then explain how to apply it. See typical ISSP contents →

Scope the perimeter, review the existing setup, interview business and IT teams, define responsibilities and principles, draft an applicable document — not a generic template —, have leadership validate it, roll it out, then control and review. An ISSP is built with your teams; it is not imported from a template. See the drafting method →

Leadership owns it. Drafting is usually led by the CISO, the CIO or an external provider, with the relevant business teams. It is not an “IT-only” document: without leadership validation and team ownership, it remains a dead letter.

An ISSP named as such is not universally mandatory for every business. It becomes required or strongly expected depending on particular obligations and context: ISO 27001 certification, NIS2, public procurement, customer contracts, regulated sectors. Even without a formal obligation, it remains useful as soon as the IT landscape, the data or the providers justify it.

The ISSP is the global governance document designed to structure information-system security. The IT user charter defines the rules for using digital tools that apply to users (passwords, messaging, equipment, Internet, software, storage, expected behaviours). The charter can follow from the ISSP, but it does not replace it. See ISSP vs IT user charter →

The ISSP is the framework document: it sets security orientations and rules. The ISMS (information security management system), notably under ISO 27001, organises management more broadly: governance, risks, objectives, controls, improvement and evidence. The ISSP is a building block of the ISMS, not the ISMS itself. See the ISSP / ISO 27001 link →

A structured ISSP is an important building block of an ISO 27001 approach. Drafting an ISSP is not enough to obtain certification: the ISMS also requires risks, controls, evidence and continual improvement. See ISSP and ISO 27001 →

The ISSP sets the security framework, including continuity principles. The Business Continuity Plan (BCP) is an operational plan: how the organisation continues operating in degraded mode during an incident. It is a resilience piece of work heavier than a simple ISSP chapter; it is sized according to IT complexity and can be scoped separately.

The BCP (Business Continuity Plan) defines how the organisation continues operating in degraded mode during an incident. The DRP (Disaster Recovery Plan) defines how to return to normal after the incident. They are complementary, not interchangeable. A full BCP or DRP is scoped separately.

Yes as a basis for thinking — but not as an operational document without adaptation. A generic template will not reflect your IT landscape, your business or your obligations. It generally will not pass an ISO 27001 audit. See the gap between a template and a workable ISSP →

As a guide: Essential ISSP €1,800–3,500 excl. VAT, ISSP + operational procedures €3,500–6,500 excl. VAT, full security governance €5,000–9,000 excl. VAT+. Price depends in particular on IT landscape size, sites, entities, maturity, documentation, number of supporting policies, sector requirements, need for BCP/DRP, interviews, training and deployment. A full BCP or DRP is scoped separately. See pricing →

In practice, often 4 to 8 weeks, depending on scope, available documentation, number of interviews and validation time. An essential ISSP can be faster; full governance, with procedures, training and deployment, takes longer. This is not a universal duration. See the drafting steps →

An annual update is not a universal obligation: it depends on the context and the applicable requirements. A periodic review is recommended, but above all each significant change (new tool, cloud, incident, merger, regulation, critical provider) should trigger a check that the policy remains fit for purpose. See update triggers →

No. It organises the security rules but must be accompanied by technical, human and organisational measures that are actually implemented: access, backups, detection, awareness, incident procedures. Without application, the ISSP remains a document. See the audit, pentest, protection and ISO 27001 journey →