Which content areas does a complete Enterprise Information Security Policy cover?

From business context and scope through CIA protection goals, risk management, and responsibilities, to formal enactment with the CEO's signature.

The main blocks:

• Grundsätzliches: the company's business and the role of information/IT; environment (markets, technologies); key assets, locations, main threats, stakeholders and their security needs; legal, regulatory, and contractual requirements
• Goals & principles from the corporate risk policy, plus management commitment; reference to risk/security culture, awareness, communication, training; the targeted security maturity level (maturity model)
• Definitions (information, IT systems, components) and scope/Abgrenzung — what's in (information, systems, processes over the whole lifecycle, users) and what's out (e.g. physical object security)
• Security and risk objectives: Vertraulichkeit (incl. Datenschutz, banking secrecy, business secrets), Integrität (possibly Authentizität, Non-Repudiation, reliability), Verfügbarkeit
• Risk management: corporate risk process, criteria for risk estimation and acceptance, methods
• References: business continuity & IT emergency planning, outsourcing and external-partner security rules, further directives for individual risk areas
• Resources committed; Verantwortlichkeiten (business unit heads, CISO, CIO, process/system owners, internal audit, employees)
• Geltungsbereich (e.g. all employees) and Inkraftsetzung: date + CEO signature

Tip: Remember the skeleton as context → scope → goals → risk → responsibilities → enactment. The CEO signature at the end is not decoration — it's what makes everything above it binding.