The information security policy is the key tool for designing information security in a company. It defines all information security support for companies, its strategic and operational guidelines and focus. Security management standards define information security policy as a mandatory and central starting point for companies’ security activities. Despite the importance of the matter, there is no methodological support for the development of information security policies. This results in the organisation’s core business and other needs being overlooked. The company’s information security can then focus on wrong things from the point of view of the organisation’s business needs and assets. This leads to significant problems, the most typical of which is that the information security of an organisation does not support the organisation’s other corporate strategy activities, but is a slowdown. Another problem, which is reflected in the lack of development of security policies, is reflected in the indiscriminate acquisition of security solutions: the acquisition of security solutions is guided by “others have the solution”, or “this might be needed”, rather than based on strategic development and starting from optimal business support.The project aims to solve the above problems. The project will develop a scientifically tested methodology to develop an organisation-specific security policy appropriate to each object, organisation or system. The method is developed in practice in different contexts of participating companies in cooperation with the University of Jyväskylä Faculty of Information Technology and the University of Turku School of Economics. Business partners, such as Digia Finland Oy, Ixonos Oyj, Net Man Oy and Relator Oy, represent different areas of the business community, including municipalities and cities, large company context and SME context, and critical systems. This will ensure that the new method to be developed will be scaled up.