Information security policy, the document every assessment asks for first

A policy that survives scrutiny states its scope — which entities, systems and people it covers — and names accountability at a level senior enough to enforce it. Beyond that it sets the rules that everything else refers back to: classification and handling of information, access control, acceptable use, cryptography, physical and personnel security, incident reporting, business continuity, and the security expectations placed on suppliers.

Under ISO/IEC 27001 the policy is a required, approved and communicated document with a defined review cycle, and the supplier clauses matter for third-party risk specifically: the 2022 control set expects security requirements to be agreed with suppliers and monitored through the life of the relationship, not stated once at signature.

Three things, quickly. Is it approved and dated? An unsigned policy with no review date is a template. Does its scope match the service you are buying? Group policies frequently exclude the subsidiary or the platform you are contracting with. Does it match the questionnaire? Where the policy says quarterly access reviews and the questionnaire says annual, one of them is wrong and the discrepancy is worth more than either answer alone.

Cross-checking claims against documents is exactly the kind of work that scales badly by hand and well by machine — it is what ARIA's response validation does against the 157 Universal Controls, which is a more useful reason to collect the policy than filing it as evidence that you asked.