A practical starting point informed by NIST, CIS and NCSC guidance. Adapt it to your risks and duties. It does not certify compliance with a standard.
Make this policy yours
Business name: ____________________
Approved by: ____________________
Security lead and contact: ____________________
Backup contact: ____________________
Approval date: ____________________
Next review date: ____________________
Who this policy covers
We protect the information and systems that keep our business running. This policy applies to owners, staff, temporary workers and contractors who use our business information, devices or accounts, including approved personal devices and cloud services.
Before using it, the owner must fill in the business name, security lead, backup contact and approval date in the adoption fields. Explain the rules to everyone and arrange the supporting security controls. A signed policy alone does not make a business secure.
1 Choose who is responsible
The owner approves this policy, provides time and money for the agreed protections, and names a security lead and a backup contact. The security lead keeps the device and account lists, follows up concerns and works with our IT support.
Everyone must follow these rules, complete training and report mistakes or concerns promptly. Staff can report a genuine concern without being blamed for speaking up.
2 Protect your accounts
Use your own account and only the access needed for your job. Do not share passwords, sign-in codes or approval requests. Shared mailboxes should use named access rather than a shared password.
Use an approved password manager and a different, long password for each account. Our default is at least 15 characters where the service supports it. Change a password if it is exposed, reused or suspected to be stolen, rather than simply because a calendar date has passed.
Use multi-factor authentication (MFA), which adds a second sign-in check, wherever available. Prefer a passkey or security key that resists fake sign-in websites. Never approve a sign-in you did not start. Keep recovery codes safe and tell the security lead if you lose a sign-in device.
3 Look after devices and software
Use approved devices and software. Keep security updates, device encryption, screen locking and malware protection switched on. Lock the screen when you step away and protect devices from loss or unauthorised use.
Do not install unapproved apps, connect unknown USB drives or turn off security tools. Ordinary work must use a standard account; use separate administrator access only for approved maintenance.
4 Handle information carefully
Collect and keep only the customer, staff and business information we need. Save work in approved business storage so it can be protected and backed up. Do not use personal email, unapproved messaging, public file links or unapproved AI tools for private business information.
Check recipients and permissions before sharing. Use approved encrypted transfers for sensitive files. Follow our retention schedule, securely delete information when it is no longer needed, and keep records that must be preserved for a dispute or investigation.
5 Stop and check unusual requests
Be cautious about unexpected links, QR codes, attachments, calls and messages, even if they appear to come from someone we know. Open a known app or saved website address instead of an unexpected sign-in link.
Confirm new payment details, money transfers and requests for private information through a known contact method. Do not rely on the phone number in the message, a familiar voice or a video alone. Follow our approval process before paying.
6 Work safely away from the office
Use only approved remote access and personal devices. Keep work separate from personal use, protect screens and paperwork, and do not let family or other people use business accounts.
Avoid shared public computers. Use a trusted connection and the approved secure remote-access service where required. Report a lost phone, laptop or storage device immediately.
7 Report problems straight away
Report suspicious messages, unexpected sign-ins, missing devices, malware alerts, lost information and accidental sharing to the security lead immediately. Use the backup contact if the lead is unavailable, and a known phone number if business email may be compromised.
If you think a device is infected, stop using it and disconnect its Wi-Fi or network cable if you can do so safely. Keep it powered on unless IT support directs otherwise. Do not delete messages, wipe the device or investigate it yourself. Record what happened and when.
The owner and IT support decide how to contain the problem, protect evidence, recover safely and communicate. The owner checks any duties to notify customers, regulators, insurers or law enforcement with suitable advice.
8 Manage people and suppliers
Approve access before someone starts work and remove it promptly when they leave or no longer need it. Return business equipment and transfer work records through an approved process.
Use suppliers that can explain how they protect our information, report incidents and return or delete our data. Give suppliers only the access they need, for only as long as they need it.
9 Back up and keep the business working
The security lead ensures important data is backed up, backup failures are checked and recovery is tested. Keep a protected copy that an attacker using an ordinary business account cannot change or delete.
The owner agrees how much work we can afford to lose and how long we can operate without each important system. Keep an offline contact list and a simple way to continue essential work during an outage.
10 Check and improve
Train people before they receive access, refresh their knowledge regularly and discuss new scams when relevant. Review the policy at least yearly and after an incident or important change.
The security lead checks the supporting controls and records gaps, owners and target dates. Any exception needs the owner’s written approval, an explanation of the risk, extra safeguards and an expiry date. Repeated or deliberate breaches are handled through our normal staff or contract process.
Staff acknowledgement
I have read this policy, understand what is expected of me and know how to report a concern. I will ask for help if I am unsure.
Name: ____________________
Signature: ____________________
Date: ____________________
Guidance used
These guides inform this toolkit. The practical frequencies and targets above are suggested business choices, not a complete mapping to every safeguard.
Use the updated toolkit
The editable Word downloads contain the same guidance as these pages.
Download policy ↓ Download controls ↓