Key components of an ISP include purpose, roles and responsibilities, risk management, access control, data classification, physical and environmental security, disaster recovery, compliance, training and awareness, and monitoring and auditing.