The information security policy aims to establish the organization’s commitment to information security, define the overall objectives and scope of the ISMS, and provide a framework for setting security objectives and requirements.