Employees compliance with information security policies (ISPs) depends on communicating clear and comprehensible content. However, existing research has shown that many ISPs are of poor communicative quality. Large language models (LLMs) could enhance ISPs if finetuned on high-quality data, but to do such fine-tuning requires a conceptual model for classifying the data and evaluating the resulting text. Therefore, as a step in this direction, the aim of this paper is to develop a conceptual model of ISPs using speech act theory as a theoretical lens. We use conceptual modelling and document analysis to develop the model and use selected parts from the SEQUAL framework to evaluate the model. Analysing 600 ISP statements from ten British National Health Service ISPs, we present a class diagram containing 19 classes, six of which address ISP statement quality as speech acts. The SEQUAL evaluation points to potential areas for improving the model’s semantic, empirical, physical and deontic qualities before using it to fine-tune LLMs to improve ISP content.