## 1 Introduction  
A security policy ensures sensitive information and information systems within an organisation are protected from unauthorised access and use [1]. These policies outline how sensitive information will be handled as well as the steps that will be taken to ensure data protection against unauthorised access, alteration, disclosure, or destruction. Organisations should tailor them to meet their specific needs and objectives as part of their overall security program. It should include guidelines for physical security, access control, data encryption, and user authentication. Furthermore, security policies should specify how to respond to security incidents, such as data breaches. A standard for cybersecurity management, ISO 27001 [2], should be considered when organising an ISP. Various guidelines and effective practices (e.g., ISACA, ISO 27000, and NIST) are available to help companies apply their own security policies.  
The ISO 27001 standard (ISECT, 2012) is part of the ISO 27,000 family of standards [2]. It represents a group of guidelines involved in security management systems. ISO 27001 is a British standard that was first established in October 2005. An example of a security management request is shown in Figure 1. An enterprise can apply a systematised and active approach to security risk management by selecting security processes to ensure the safety of vulnerable resources within a well-defined border.  
Thus, the main purpose of this research is to develop a novel administration metamodel for managing and organising diverse security policy practices using a design science approach based on the ISO 27001 controls. The developed metamodel, which is called the information security policy metamodel (ISPM), aims to solve the redundancy, heterogeneity, and ambiguity of information security policy (ISP) practices by gathering and combining the common security practices into three high abstract levels. The three high levels of the developed metamodel control how the ISP practices behave. These modelling rules will be used to combine, structure, and organise all security practices in the ISP field into the developed ISPM. As a result, ISP users and experts will have access to organised, structured, managed, and shared ISP practices well-tailored to their organisations. This study developed and validated the ISPM using a metamodelling approach, which is a kind of design science method. Metamodelling is the process of creating a metamodel representing a particular domain. It is a way of understanding the concepts and relationships between the components of a system. It involves analysing the structure of the data, behaviour of the system, and component interactions [3].  
The contribution of this study is to provide a comprehensive representation layer for the ISP field, which is called ISPM, to assist several organisations in identifying, preparing, managing, and developing security policy practices based on their own requirements. The developed metamodel also offers an approach to develop a policy framework compliant  
Figure 1: ISO 27001 international standard focused on information security.  
with international standards such as ISO 27001. ISPM provides a detailed analysis of the different components of an ISPM framework, including the scope, objectives, roles, and responsibilities, as well as the security controls. Furthermore, it offers an overview of different types of security policies, as well as the importance of implementing them. Finally, it provides guidelines and best practices for organisations to ensure that their security policy is up-to-date and secure.  
The remainder of this article is organised as follows: The related work is reviewed, and the problem is stated in Section 2; then, the methodology is described in Section 3. Afterward, the findings and discussion are provided in Section 4. Finally, the conclusion of the study and future work are provided in Section 5.