Last updated: 2026-10-30
ISSP stands for Information Systems Security Policy: the management-approved document that sets out what an organisation protects, against which risks, who is responsible and which rules everyone follows. Every security procedure and audit points back to it. The hard part is proving it on the ground, starting with IT fleet security: every laptop and phone it covers.
ISSP meaning: what does ISSP stand for?
In information security, ISSP stands for Information Systems Security Policy, also written information system security policy. It is a written set of principles and rules that defines an organisation's security objectives and how it meets them, covering technology, organisation and people. It is signed by management, shared with staff and reviewed regularly.
Letter by letter, the acronym reads:
I: Information
S: Systems
S: Security
P: Policy
The first S therefore refers to the information systems being protected, and the second S to security. Outside IT, the same letters are used by unrelated bodies, such as the International Social Survey Programme, a cross-national research survey; this article covers only the security meaning.
The policy answers three questions. What does the organisation need to protect, and why? Which risks does it accept, reduce or transfer? Which rules apply to everyone, from the CEO to a contractor in another country? Detailed procedures, such as how to enrol a new laptop or how to report a phishing email, sit below the policy and implement it.
Two classic security goals frame almost every ISSP: the confidentiality, integrity and availability of information (the "CIA triad"), plus traceability, meaning the ability to know who did what and when. A good policy translates those abstract goals into concrete, checkable rules.
ISSP, information security policy or issue-specific security policy?
The acronym is used in two ways. In French-speaking companies, ISSP is the English translation of PSSI (politique de sécurité des systèmes d'information), the organisation-wide policy described in this article. In English-language frameworks, the same document is usually called an information security policy, the term ISO/IEC 27001 uses in clause 5.2.
US textbooks and NIST guidance also use ISSP for an issue-specific security policy: a narrower document covering one topic, such as acceptable use, remote work or bring your own device (BYOD). NIST SP 800-12 distinguishes programme, issue-specific and system-specific policies, and Whitman and Mattord's textbook Principles of Information Security uses a matching three-level model.
Level | Common abbreviation | Scope | Example |
|---|---|---|---|
Enterprise or programme policy | EISP | Sets direction, scope and responsibilities for the whole organisation | Organisation-wide information security policy |
Issue-specific security policy | ISSP | Covers one technology or behaviour used across the organisation | Acceptable use, email, remote work, BYOD, password policy |
System-specific security policy | SysSP | Rules and configurations for one system | Firewall rule set, access control list for an ERP |
The same textbook describes three ways to organise issue-specific policies: independent documents, each tailored to one issue; a single comprehensive document covering every issue; or a modular set of policies managed centrally, which is the most common choice in growing companies because each module can be updated without reopening the whole policy. In practice, a mature organisation has one top-level information security policy and several issue-specific policies attached to it.
Why does a company need an information security policy?
A company needs an information security policy because security decisions otherwise depend on whoever is in charge that week. The policy gives the IT team a mandate, makes rules enforceable with employees and suppliers, and provides the evidence that customers, auditors and regulators ask for. For a scale-up selling to larger accounts, it is often a prerequisite to closing deals.
Three drivers usually push a company to formalise its ISSP:
Certification and audits. ISO/IEC 27001 requires a documented information security policy approved by top management (clause 5.2), and SOC 2 auditors review written policies as part of the control environment. No policy, no certificate.
Regulation. The EU NIS2 directive requires essential and important entities to adopt "policies on risk analysis and information system security" (Article 21). The GDPR requires appropriate technical and organisational measures to protect personal data (Article 32), and a written policy is the first evidence a data protection authority will look for.
Customer due diligence. Enterprise buyers send security questionnaires before signing. Questions such as "Are all laptops encrypted?" or "How do you revoke access when an employee leaves?" are answered by pointing to the policy and the evidence behind it.
The cost of not having one is concrete. Verizon's 2025 Data Breach Investigations Report found that the human element was involved in roughly 60% of breaches, and that third-party involvement doubled to 30% of breaches. Both are areas where a written policy, training and supplier rules make the difference (Verizon DBIR).
What does an ISSP contain?
A typical ISSP contains a scope and context section, security objectives, roles and responsibilities, and then thematic rules: asset management, access control, device and endpoint security, network and cloud security, supplier management, incident response, business continuity, training and compliance. It ends with how the policy is reviewed, how exceptions are handled and what sanctions apply.
The structure below follows the topics most auditors expect, aligned with the organisational, people, physical and technological control themes of ISO/IEC 27002:2022.
Section | What it defines | Typical owner |
|---|---|---|
Scope and context | Entities, sites, countries, systems and people covered; legal and contractual requirements | Management, CISO or IT lead |
Objectives and risk approach | Security goals, risk appetite, link to the risk assessment | Management |
Roles and responsibilities | Who owns security, who approves exceptions, who manages incidents | Management, HR |
Asset management | Inventory of hardware, software and data; data classification | IT |
Access control | Identity management, MFA, least privilege, joiner-mover-leaver process | IT, HR |
Endpoint security | Encryption, OS updates, MDM, antivirus or EDR, lost-device process | IT |
Network, cloud and SaaS | Secure configuration, backups, approved applications, shadow IT | IT |
Suppliers | Security requirements for providers and subcontractors | Procurement, IT |
Incident response and continuity | Detection, escalation, notification deadlines, recovery plans | IT, management |
People | Awareness training, acceptable use charter, remote work rules | HR, IT |
Compliance and review | Audits, indicators, annual review, sanctions | Management, CISO |
ISSP examples: how to write rules an auditor can check
A good ISSP rule names the object, the tool or threshold, the owner and the control. A 15-page policy that says "laptops must be encrypted" is weaker than a 5-page one in which an auditor can verify each rule in a few minutes.
Examples of rules written to be verifiable:
"All company laptops use FileVault or BitLocker, enforced by MDM, with compliance checked monthly by IT."
"Multi-factor authentication is mandatory for email, the identity provider and every SaaS tool holding customer data."
"A leaver's accounts are disabled no later than their last day, and their devices are returned within 7 days."
"Critical data is backed up daily, including one offline copy, and a restore is tested every quarter."
"Every supplier with access to company systems signs a security clause and is reviewed once a year."
The detailed steps to draft, validate and roll out the document are covered in our guide on how to define and implement an ISSP.
How does an ISSP apply to laptops and mobile devices?
The endpoint section is where an ISSP is most often tested, because laptops and phones leave the office, hold company data and are handled by every employee. The policy should require a complete device inventory, disk encryption, automatic updates, central management through MDM, a lost or stolen device procedure, and certified data erasure when a device is returned, reassigned or retired.
These are not theoretical rules. ISO/IEC 27002:2022 dedicates specific controls to user endpoint devices (8.1), inventory of assets (5.9), use of cryptography (8.24), equipment used off-premises (7.9) and secure disposal or re-use of equipment (7.14). An auditor will not just read the rule: they will ask for evidence that it is applied on every device.
From rule to evidence: the endpoint checklist
The gap between most ISSP templates and real audits lies here. Each rule below is paired with the proof an auditor or a customer security questionnaire will typically request.
ISSP requirement | Evidence to produce | How it is usually done |
|---|---|---|
Every device is inventoried and assigned | Up-to-date inventory: serial number, model, user, location, status | IT asset management tool or device dashboard, synced with HR arrivals and departures |
Disks are encrypted | Report showing encryption status per device (FileVault on macOS, BitLocker on Windows) | MDM policy enforcing encryption and escrowing recovery keys |
Operating systems are supported and patched | OS version per device, patch compliance rate | MDM update policies; replacement of devices that cannot run a supported OS (Windows 10 support ended in October 2025) |
Devices are centrally managed | List of enrolled devices versus inventory, enrolment date | Zero-touch enrolment through Apple Business Manager or Windows Autopilot |
Lost or stolen devices can be locked or wiped | Incident log with remote lock or wipe actions and timestamps | MDM remote commands, documented in the incident procedure |
Access is revoked when people leave | Offboarding records: account deactivation date and device return date | Joiner-mover-leaver process linking HR, identity provider and device recovery |
Data is erased before reuse or disposal | Erasure certificate per serial number | Certified wiping by the IT team or an ITAD provider, aligned with recognised standards such as NIST SP 800-88 |
Remote teams make this harder. When employees work in several countries, devices are shipped, repaired and returned across borders, and the evidence trail breaks easily: a laptop left with a former employee in another country is both an inventory gap and a data risk. That is why endpoint rules should name a single source of truth for the inventory and a clear owner for every step. Choosing the right management tool is covered in our guide on how to choose and install an MDM.
How is an ISSP different from an ISMS or a security charter?
An ISSP states the rules; an ISMS (information security management system) is the full management system that plans, applies, measures and improves them, as defined by ISO/IEC 27001. A user security charter or acceptable use policy is a shorter document derived from the ISSP, written for employees and often signed at onboarding.
Document | Purpose | Audience | Example content |
|---|---|---|---|
ISSP / information security policy | Sets objectives, principles and rules | Management, IT, auditors, customers | "All devices are encrypted and managed centrally" |
ISMS | Runs the policy through risk assessment, controls, indicators and continual improvement | Security team, management, certification body | Risk register, statement of applicability, internal audits |
Issue-specific policies | Detail one topic | Staff concerned | Remote work policy, BYOD policy, password policy |
User charter / acceptable use policy | Explains day-to-day obligations | All employees | "Report a lost laptop within one hour" |
The ISSP is therefore one of the first deliverables of an ISMS, not a substitute for it. Our article on ISO 27001 and SOC 2 explains how both frameworks use these documents during certification. For a step-by-step view of the standard, the ISO 27001 guide details the steps, timeline and supporting tools.
Practical box: is your ISSP audit-ready?
The policy is signed by management and dated, with a named owner.
Its scope lists every entity and country where employees work.
It links to a current risk assessment.
Each rule is specific enough to be checked (tool, threshold, frequency).
The device inventory matches the list of devices enrolled in your MDM.
Encryption and OS compliance reports can be exported on demand.
Offboarding records show device return and access revocation for every leaver.
Erasure certificates exist for every retired or reassigned device.
Employees have read the user charter and completed security awareness training.
The policy has been reviewed in the last 12 months, and after any major incident or reorganisation.
Prove your ISSP on every device with Fleet
An ISSP is only as credible as its endpoint evidence: an inventory that matches reality, encryption and OS reports for every laptop, remote lock and wipe when a device goes missing, and a clean return and erasure trail for every leaver. Each of these can be handled manually, but across remote teams in several countries every step adds time, gaps in the audit trail and risk.
Fleet runs the device side of your security policy in one platform, across 150+ countries:
Policies enforced by MDM: Fleet MDM applies your security policies, with remote enrol, configure and wipe; Fleet's security partners are ISO 27001 and SOC 2 certified.
Live inventory for auditors: every device, OS version and compliance status tracked in the Cockpit dashboard.
Secure from day one: devices arrive pre-configured through zero-touch enrolment (Apple Business Manager or your MDM), so no laptop reaches an employee outside policy.
Clean offboarding: order, deliver, store, transfer and redeploy devices from one place, with no local supplier per country.
Planned renewal: devices are renewed every 3 years, keeping the fleet on supported operating systems, and Fleet handles their second life.
Fleet already equips over 100,000 users in 1,500 companies. Book a demo and see how Fleet helps you turn your security policy into evidence on every device.
FAQ
What does the second S in ISSP stand for?
The second S stands for Security. ISSP reads Information Systems Security Policy: the first S refers to the information systems being protected, the second to security. In textbooks that use the issue-specific meaning, the second S also stands for Security (issue-specific security policy).
Is an information security policy mandatory?
It depends on your situation. It is required for ISO/IEC 27001 certification, expected in SOC 2 audits, and NIS2 requires covered entities to adopt information system security policies. Outside these cases there is no general legal obligation, but data protection laws such as the GDPR expect documented security measures.
Who writes the ISSP?
The CISO or IT lead usually drafts it, with input from HR, legal, finance and business teams. Top management must approve and sign it, because the policy commits resources and applies to everyone. Smaller companies often work with an external consultant or their managed service provider for the first version.
How often should an ISSP be reviewed?
At least once a year, and whenever something significant changes: a new country or subsidiary, a major incident, a new regulation, or a change of key tools such as the MDM or identity provider. ISO/IEC 27001 requires the policy to be maintained and to support continual improvement.
How long should an information security policy be?
There is no required length. The top-level policy is often 5 to 15 pages, with detailed rules moved into issue-specific policies and procedures. What matters is that each rule is clear, assigned to an owner and verifiable.
Conclusion
ISSP stands for Information Systems Security Policy: the document that sets the objectives, rules and responsibilities protecting a company's information systems, and the one auditors, customers and regulators read first. Its credibility rests on verifiable rules and their evidence, and for most growing companies that evidence starts with the devices: inventory, encryption, updates, MDM, offboarding and certified erasure.
See how Fleet handles this in practice
200+ devices, sourced locally and delivered pre-configured to 150 countries — buy or lease, same price.
