Cyber Security Policy for Small Business: What to Include

Security in a small business often depends on individual habits. One person uses MFA, another shares passwords on WhatsApp. One checks before paying a new supplier account, another pays because the email sounded urgent. A short written policy turns good habits into the normal way of working.

This guide explains what a practical cyber security policy should cover, section by section, and how to introduce it without creating bureaucracy.

Principles for a policy people actually follow

• Keep it short. A few clear pages beat a long document nobody reads.
• Use plain language. Write "Turn on two-step login for your email" rather than technical jargon.
• Explain why. People follow rules they understand.
• Make it practical. Every rule should be something staff can actually do with the tools you provide.
• Name owners. Each section should have someone responsible.

Section 1: Purpose, scope and roles

State briefly why the policy exists and who it applies to - employees, interns, contractors and anyone with access to business systems. Name:

• The policy owner
• Who to contact with questions
• Who to report security concerns to

Section 2: Acceptable use

Set expectations for using business systems:

• Business accounts are for business use
• No installing unapproved software on business devices
• No using business email to sign up for unrelated services
• Approved tools for file sharing, messaging and AI assistance

Include a line on AI tools: which are approved, and that customer data, contracts and confidential information must not be pasted into unapproved tools.

Section 3: Passwords and multi-factor authentication

• Use a unique, long password for every account
• Use the company password manager to store and share credentials
• Turn on MFA for email, banking, cloud storage, website admin and social media
• Never share passwords over chat, email or SMS
• Change passwords immediately if you suspect they are exposed

Section 4: Devices - laptops, desktops and phones

Cover both company-owned and personal devices used for work:

• Screen lock with a PIN, password or biometric
• Automatic updates turned on
• Security software where appropriate
• Full-disk encryption on laptops where available
• Report lost or stolen devices immediately
• For personal devices: business data only in approved apps, and the business may remove access if the device is lost or the person leaves

Section 5: Email, messages and payments

This is where many real-world losses happen, so be specific:

• Be cautious with unexpected attachments and links
• Check the sender's address carefully before acting
• Any request to change bank details, or any unusual urgent payment, must be verified by phone using a number already on file
• Two people approve payments above a level the business decides
• Report suspicious messages to the policy owner rather than just deleting them

Section 6: Data handling and classification

Help staff understand which information needs extra care. A simple three-level scheme works well:

| Level | Examples | Handling rules |
| --- | --- | --- |
| Public | Brochures, website content | No restrictions |
| Internal | Internal procedures, general reports | Share only within the business |
| Confidential | Customer personal data, financials, contracts, source code | Access only for those who need it; store in approved systems; share securely |

Under the DPDP Act 2023, businesses should collect personal data for a clear purpose, protect it with reasonable security safeguards and not keep it longer than needed. Your policy should state where personal data may be stored, who may access it and how long it is kept. Check specific obligations with your legal adviser as the Rules are phased in.

Section 7: Access control and offboarding

• Access is based on role, using least privilege
• Every person has their own account - no shared logins
• Access is reviewed regularly, and at least every quarter
• When someone leaves, all access is removed on their last day and shared credentials they knew are changed
• An access register lists systems and who has access

Section 8: Software and updates

• Only licensed software from official sources
• Updates applied promptly on devices, servers and websites
• Unsupported systems are planned for replacement
• Website CMS, themes and plugins are updated on a regular schedule

Our website maintenance service covers updates and monitoring for business websites.

Section 9: Backups

• What is backed up, how often and where
• At least one copy off-site and one offline or immutable
• Regular restore tests, with dates recorded
• Who is responsible for checking backups

Section 10: Remote work and networks

• Use secure home Wi-Fi with a strong password
• Avoid public Wi-Fi for sensitive work, or use an approved secure connection
• Do not leave devices unattended in public places
• Follow the same data handling rules at home as in the office

Section 11: Incident reporting

Make reporting easy and blame-free. Staff should know:

• What to report - suspicious emails, unusual account activity, lost devices, data sent to the wrong person
• Who to report to, with a phone number
• That early reporting is always welcome, even for mistakes

Link to your incident response plan, which covers containment, recovery and any reporting obligations such as CERT-In directions.

Section 12: Vendors and third parties

• Vendors get only the access they need, through individual accounts
• Contracts include confidentiality and data protection terms
• Vendor access is removed when work ends
• Key accounts - domain, hosting, cloud - stay in the business's name

Section 13: Training and review

• New staff read and acknowledge the policy during onboarding
• Short refresher sessions at least once a year
• The policy is reviewed annually and after significant changes or incidents

Policy summary table

| Section | Key rule | Owner |
| --- | --- | --- |
| Acceptable use | Business systems for business use; approved tools only | Policy owner |
| Passwords and MFA | Unique passwords, password manager, MFA everywhere | Each user, checked by IT |
| Devices | Screen lock, updates, report losses | Each user |
| Email and payments | Phone verification for bank changes | Accounts team |
| Data handling | Classify and protect confidential data | Data owners |
| Access control | Least privilege and same-day offboarding | Owner or office manager |
| Software and updates | Licensed and updated | IT or maintenance partner |
| Backups | 3-2-1 with restore tests | IT or maintenance partner |
| Remote work | Secure networks and devices | Each user |
| Incident reporting | Report early, without blame | Everyone |
| Vendors | Least access, contracts, removal at end | Owner |

Rolling it out

1. Draft the policy with your IT or security partner
2. Have the owner approve it
3. Walk the team through it in a short meeting, focusing on the why
4. Provide the tools the policy requires - password manager, MFA, backup system
5. Ask everyone to acknowledge it
6. Review progress after a month and fix anything impractical

Our cloud and DevOps team can help implement the technical controls, such as access management, monitoring and backups.

Common mistakes when writing a policy

• Copying a large company's template. It will be too long and full of rules that do not fit a small team.
• Writing rules without providing tools. Requiring unique passwords without a password manager simply leads to workarounds.
• Forgetting contractors and vendors. Freelancers and agencies often have as much access as staff.
• Making it punitive. If people fear blame, they hide mistakes - and early reporting is your best defence.
• Writing it once and forgetting it. A policy that mentions systems you no longer use loses credibility.

Making the policy stick

A policy changes behaviour only when it is part of daily work. Include it in onboarding for every new team member, mention one section briefly in team meetings now and then, and share real examples - a phishing email someone reported, a payment-change request that was correctly verified. Recognising people who follow the policy encourages others far more than warnings do.

Key takeaways

• A short, plain-language policy is better than a long one nobody reads
• Cover acceptable use, passwords and MFA, devices, email and payments
• Classify data and protect personal data in line with the DPDP Act 2023
• Make access control and offboarding routine
• Include updates, backups, remote work, incident reporting and vendors
• Train staff, provide the right tools and review every year

If you would like help writing a security policy that fits your business, book a free consultation. We will draft it with you and help put the supporting controls in place. Learn more about our cyber security services.