Which standards require a code of conduct?

ISO/IEC 27001:2022: 6.2; The NIS2 Directive: Art. 21(2)(g).

What must a code of conduct contain under ISO 27001?

6.2: State the security responsibilities of both the person and the organization in the employment agreement. The ISO 27002 guidance beside 6.2: Requires employment contractual agreements to state what the individual and the organisation are each responsible for with respect to information security.

Who should own the code of conduct?

The clauses imply the head of HR. The register names the role so the line on your list can carry a name.

How often should a code of conduct be reviewed?

Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).

Is there a template for a code of conduct?

Yes: https://compliance.theartofservice.com/policy-templates/information-security-code-of-conduct

Every policy type · Conduct

Code of conduct

The standard of behaviour the organisation asks of everyone who works for it, including what it asks of them about information.

How the register reads it

Also called	code of ethics, staff handbook
Family	Conduct
Document type	Policy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds into	The regimes accept it folded into the hr security policy (joiners, movers, leavers); when neither is listed, the gap is counted once, under the parent.
Expected owner	The head of HR.
Review cadence	Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list when	never on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, hr security policy (joiners, movers, leavers), is).
Template	Information security code of conduct.

Which standards require it, and what each expects it to contain

2 requiring clauses, 2 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 6.2 Terms and conditions of employment

State the security responsibilities of both the person and the organization in the employment agreement.

What the ISO 27002 guidance expects the document to say: Requires employment contractual agreements to state what the individual and the organisation are each responsible for with respect to information security.

Evidence an auditor accepts: Employment contracts and contractor agreements containing the information security responsibilities of both parties; evidence the clauses cover confidentiality, acceptable use, return of assets and obligations continuing after employment; signed acceptance records for personnel in scope, including those who joined before the current clause set
Common gap: missing security clauses in standard contracts
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

The NIS2 Directive

NIS2 Art. 21(2)(g) Basic cyber hygiene practices and cybersecurity training

Cyber hygiene is the common baseline the Directive expects everywhere: keeping software and hardware updated, managing configuration of devices, controlling and limiting administrator-level accounts, managing new installations, changing credentials, segmenting networks and backing up data. The recitals also point at zero-trust principles and user awareness as part of the same baseline. Training here is the workforce limb, distinct from the management body training in Article 20(2), and it needs to reach the roles that actually handle the risk rather than being one annual module for everyone. The value of this category to an auditor is that it is measurable: patch currency, privileged account counts and training completion are all countable, and a claim of good hygiene that cannot produce those numbers is not evidenced.

Evidence an auditor accepts: Patch and update currency reporting across the in-scope estate, including exceptions; secure configuration baselines and compliance measurement against them; the privileged account inventory with justification and periodic review
Common gap: Hygiene asserted for servers while endpoints, network devices and operational technology are unmeasured
Source: NIS2 Directive

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Anti-bribery and corruption policy · Social media policy