The Cambridge Dictionary defines a policy as “a set of ideas or a plan of what to do in particular situations that has been agreed to officially by a group of people, a business organization, a government, or a political party”.
In the context of ISO 27001’s ISMS, an Information Security Policy is therefore a plan that defines what to do to maintain the security (i.e. confidentiality, integrity & availability) of information, which has been agreed by an organisation.
It generally contains the scope, objectives, a commitment to keep information in scope secure and a commitment to continuous improvement. It has to be formally documented, be communicated within the organisation and be available to interested parties as appropriate (e.g. to customers).