What it asks for. An information security policy and supporting topic specific policies should be defined, approved by management, published, communicated to relevant personnel and interested parties, acknowledged, and reviewed at planned intervals and when significant changes occur.
In practice. A short top level policy approved by top management sets direction, supported by topic specific policies on areas such as access control, cryptography, backup and supplier security. Each policy has an owner, a review date and a version history. Staff and relevant third parties can find the policies easily and acknowledge them. Evidence includes approval records, review history, communication records and acknowledgements.
Common gaps. Policies are often copied from templates and do not describe what the organisation actually does. Review dates pass unnoticed, and topic specific policies conflict with each other or with technical configurations.