# Adopting and rolling out policies

Choose, review and approve your policies, then get the right people to read and acknowledge each version, as ISO 27001 and ISO 9001 expect.

Source: https://sted.digital/docs/guides/policy-adoption-and-rollout · Last reviewed 17 October 2026 · Strand Guides

Rolling out a policy well means the right people know the approved version and can say what it asks of them. Choose the policies your requirements need, adopt only commitments you can keep, approve them, decide who must read each one, announce and brief, track acknowledgements weekly, and repeat for every new version.

## When you need this

ISO 27001:2022 5.2 requires top management to set an information security policy, communicate it inside the organisation and make it available to interested parties as appropriate. ISO 27001:2022 Annex A 5.1 adds topic-specific policies that are approved, published, communicated, acknowledged by relevant people and reviewed at planned intervals. ISO 27001:2022 7.3 asks that people know the policy and their part in it, and 7.4 that you decide what you communicate, when, to whom and how. ISO 9001:2015 5.2.1 and 5.2.2 set the same duties for a quality policy, with 7.3 and 7.4 for awareness and communication.

The triggers are a first set of policies, a new version, a new joiner, and an audit finding that staff did not know a rule. The policy owner runs the rollout, backed by top management.

This is guidance to help you understand the requirement, not legal advice.

## Before you start

You need the list of standards, contracts and risks your policies must answer, a list of staff by role, and a senior sponsor who will announce the policies in person. Decide where staff will read them and how you will record acknowledgement.

For a first set of eight to twelve policies in a firm of 30 people, allow a week to review and approve, then two to four weeks for reading and acknowledgement. A single new version takes a day to approve and a fortnight to roll out.

## Steps

1. Choose the policy set. List the top-level policy and the topic-specific policies your standards, contracts and risks require, with an owner for each. Done when every policy on the list has an owner.
2. Draft each policy from a template, adapted to how your organisation works. Done when every policy has a draft.
3. Review each draft section by section, and adopt only the requirements you meet today or will meet by a set date. Done when every requirement is adopted or deliberately left out.
4. Approve each policy. Have top management approve the top-level policy, and the owner or top management approve the others. Done when every policy is approved with a date.
5. Decide who must read each policy and attest to it, by role. Done when every role has its list of policies.

An administrator, or a Policy and Process Owner who owns the document, assigns and removes its trainees.
Training in Sted is the person's own attestation, on the current approved version, that they are aware of and understand the document and accept their role in it; nobody can complete it for someone else.

6. Announce the policies. Have the senior sponsor say what is new, why it matters and the read-by date. Done when every person in scope has received the announcement.
7. Brief the teams whose work changes, in a short session that shows the new rule in their own tasks. Done when each affected team has had its briefing.
8. Track acknowledgement weekly against the list from step 5, and chase anyone outstanding. Done when everyone has acknowledged, or each exception has a reason and a date.
9. Make the policies available to interested parties as appropriate, such as customers who ask for them. Done when you know which policies you share and with whom.
10. Review each policy at its planned interval and after a significant change, and repeat steps 5 to 8 for each new version. Done when every policy has a next review date.

## Deciding what you can commit to

Every requirement you adopt becomes something an auditor can test. A policy that says access is reviewed quarterly creates a nonconformity the first quarter you miss. When you review a draft, tick a requirement only if it describes what you do, or what you will do by a date you can name.

### Say what you do, then do what you say

Leave out a requirement you cannot meet yet, and record the gap in your risk treatment plan with a date. That is honest, and an auditor can see the plan. The opposite failure is a policy so vague it commits to nothing; the standards ask for commitments, so keep the ones that matter and make them specific.

## Acknowledgement is not awareness

Acknowledgement shows a person confirmed they read a version. Awareness shows they know what it means for them. Auditors test both: they check acknowledgement records under Annex A 5.1, then ask a developer, a salesperson and a manager what the policy expects of them under clause 7.3.

Track acknowledgement as a count by week, and stop chasing when the gap is people on leave with a recorded return date. Test awareness with two or three questions in team meetings, or a short quiz after a briefing.

## Worked examples

### ISO 27001, a 30-person firm rolls out four policies

Kestrel Labs approves its Information Security Policy and three topic-specific policies (access control, acceptable use and remote working) on 2 March 2026. All 30 staff must read the first three; the 11 people who work from home read the remote working policy too. The CEO announces them at the all-hands on 4 March with a read-by date of 25 March. Engineers get a 20-minute briefing on the new access request route.

Acknowledgements for the security policy reach 18 of 30 in week one, 26 in week two and 29 in week three. The last person is on parental leave and acknowledges on her return on 20 April, as recorded. The remote working policy, with 11 readers, is complete in two weeks. At the stage 2 audit on 12 May, the auditor samples the records and asks three staff what the acceptable use policy says about personal email; all three answer correctly. In September the access control policy gains a rule on contractor accounts; version 2 goes back to all 30 readers, with a briefing for the 14 people who manage contractors, and 29 acknowledge it within ten days.

### ISO 9001, a quality policy on the production floor

Pennine Fabrications' quality policy commits to delivering right first time. Under ISO 9001:2015 5.2.2 it must be understood and applied, not only posted. Each shift supervisor spends ten minutes explaining what right first time means on their line: first-off inspection before a batch runs, and stopping the line for a defect. The auditor asks an operator what the policy means for her job, and she describes the first-off check. New starters get the same ten minutes in their first week, recorded on their induction sheet, so the evidence covers joiners as well as the original rollout.

## Checklist

- [ ] Every policy in the set answers a named standard, contract or risk.
- [ ] Every policy has an owner and a review date.
- [ ] Every adopted requirement describes current practice or has a dated plan.
- [ ] Top management approved the top-level policy.
- [ ] Each role has a defined list of policies to read.
- [ ] A senior person announced the policies with a read-by date.
- [ ] Teams whose work changed were briefed.
- [ ] Acknowledgement is tracked against the role list, with exceptions explained.
- [ ] Awareness is tested beyond acknowledgement.
- [ ] Each new version is re-acknowledged by the people it applies to.

## How Sted helps

Sted drafts your policies and procedures from its knowledge base, adapted to your organisation, for you to review.
You review a new draft section by section, ticking the requirements you adopt; standard sections are adopted for you.
An administrator, or a Policy and Process Owner who owns the document, approves a Draft or starts a new version of an Approved one, and only an administrator assigns a document's owner; a document still awaiting review cannot be approved.
Training is completed against a specific approved version; a new version asks people to train again.
Re-issuing training on an unchanged version is not available yet.
Administrators and Policy and Process Owners see a training register of every person's training across documents, filterable by status and document.
Tasks open and close themselves from the state of your documents, records and training; you rarely create them by hand.

Sted records that each person confirmed a version. Whether people understand and apply a policy is for your managers to check and your auditor to test.

## Related standards

- [ISO 27001 leadership](/docs/standards/iso-27001/leadership): the information security policy and what clause 5.2 requires of it.
- [ISO 27001 support](/docs/standards/iso-27001/support): awareness and communication under clauses 7.3 and 7.4.
- [Document control](/docs/guides/document-control): approving, versioning and reviewing the policies you roll out.
- [Building a training and awareness programme](/docs/guides/training-and-awareness): awareness beyond policy acknowledgement.
- [Approved document](/docs/glossary/approved-document): why only an approved version is rolled out.
- [Reviewing a draft](/docs/product/reviewing-a-draft): adopting requirements section by section in Sted.

## Frequently asked questions

Q: How do I roll out a new policy to staff?
A: Approve it, decide who it applies to, and have a senior person announce it with the reason and a read-by date. Brief the teams whose work changes, then track who has acknowledged it each week and chase the rest. Two to four weeks is a realistic window.

Q: Does everyone have to sign every policy?
A: No. ISO 27001:2022 Annex A 5.1 expects policies to be acknowledged by the relevant people, so assign each policy to the roles it governs. Everyone usually reads the top-level policy and acceptable use; developers read secure development; finance reads payment controls.

Q: Is a signed acknowledgement enough for an auditor?
A: It is evidence for acknowledgement, not for awareness. Auditors also interview staff to test ISO 27001:2022 7.3 or ISO 9001:2015 7.3: whether people know the policy, how they contribute and what happens if they do not follow it.