The short answer
A small-business cyber security policy should set clear rules for accounts and access, passwords and MFA, devices, software updates, firewalls, malware protection, acceptable use, data and backups, and incident reporting. The free template below has 12 sections, six of which map directly to the five Cyber Essentials controls. A policy supports certification but does not guarantee it.
On this page
- What should a cyber security policy include?
- Do small businesses need a cyber security policy?
- The cyber security policy template (IT security policy template)
- Do you need separate password, BYOD and remote working policies?
- Is a policy enough for Cyber Essentials?
- How do you put the policy into practice?
- When should you move to an ISO 27001 policy set?
- Why Sovereign Secure?
- What is the next step?
A cyber security policy template (sometimes called an IT security policy template) gives a small business ready-made rules for keeping its accounts, devices and data safe: you fill in names, dates and the services you use. The template below has 12 short sections for organisations without a security team, and six of them map directly to the five Cyber Essentials controls an assessor checks.
Copy it into your own document, or download the free Word version (.docx) or a PDF to print. Replace everything in [square brackets], delete what does not apply and have a director sign it off. A policy supports certification but does not guarantee it: the controls have to be in place on your devices, not just written down.
What should a cyber security policy include?
Who it covers, the technical rules that stop common attacks, and what to do when something goes wrong. For a small business, these 12 sections are enough:
| Section | What it sets out | Cyber Essentials control |
|---|---|---|
| 1. Purpose and scope | People, devices and cloud services covered | Scope |
| 2. Roles | Who owns the policy and who manages IT | Not a CE control |
| 3. Acceptable use | What company IT may be used for | Not a CE control |
| 4. Accounts and access | How accounts are approved, limited and removed | User access control |
| 5. Passwords and MFA | Password length and MFA | User access control |
| 6. Devices and configuration | Approved devices, screen locks and personal devices | Secure configuration |
| 7. Software updates | Supported software and the 14-day rule | Security update management |
| 8. Firewalls and remote working | Office routers, home working and public wifi | Firewalls |
| 9. Malware protection | Anti-malware and approved apps | Malware protection |
| 10. Data, email and backups | Where data lives, payment scams and backups | Not a CE control (backups are recommended) |
| 11. Reporting incidents | What to report, to whom and how fast | Not a CE control |
| 12. Suppliers and review | IT providers and review dates | Partly: accounts your IT provider uses are in scope |
Do small businesses need a cyber security policy?
In practice, yes. No UK law makes a “cyber security policy” mandatory for every small business, but UK GDPR expects appropriate security for personal data (Article 32) and, where proportionate, data protection policies (Article 24(2)), and customers, insurers and tenders routinely ask for one. It is also how everyone, including your IT provider, follows the same rules.
For where a policy fits alongside training, backups and testing, see our plan for cyber security for small businesses, and the NCSC’s free small organisations guide.
The cyber security policy template (IT security policy template)
Sections 4 to 9 follow the NCSC’s Requirements for IT Infrastructure v3.3, the current Cyber Essentials standard. The Word version (.docx) has the placeholders highlighted and adds a document control table, a staff acknowledgement record and pre-assessment checks; the PDF is the same template for printing or sharing.
1. Purpose and scope
- This policy sets out how [Organisation name] protects its information, its systems and the personal data it holds.
- It applies to all staff, directors, contractors and volunteers, and to every device, account and cloud service used for our work, including personal devices that access company email or data.
- [Policy owner] owns this policy, approved by [director name] on [date].
2. Roles
- [Policy owner] keeps this policy up to date and makes sure it is followed.
- [IT lead or IT provider] manages devices, accounts and security settings in line with it.
- Everyone it covers must follow it and report anything that looks wrong.
3. Acceptable use
- Company devices, email and accounts are for work. [Limited personal use is allowed / is not allowed.]
- Do not install software, browser extensions or apps that [IT lead] has not approved.
- Never share your login details, including with colleagues or anyone claiming to be from IT.
4. Accounts and access
- Accounts are created only after approval by [role]. Everyone has their own account; shared logins are not allowed.
- People get access only to the systems and data their role needs.
- Administrator accounts are separate from everyday accounts and are used only for admin tasks, never for email or web browsing.
- Accounts are disabled by [the person’s last working day], and access is removed when someone changes role and no longer needs it.
- [IT lead] reviews all accounts, including admin and supplier accounts, every [three months].
5. Passwords and multi-factor authentication
- Multi-factor authentication (MFA) is switched on for every cloud service and for any other service that offers it.
- Passwords are at least [12] characters, or at least 8 where MFA is on. There is no maximum length and no forced regular changes.
- Use a different password for every work account. We recommend [password manager] and three random words.
- Change a password straight away if you think someone else knows it, and tell [IT lead].
- Accounts lock after no more than 10 failed attempts, or allow no more than 10 guesses in 5 minutes.
Our Cyber Essentials password policy guide explains each rule, including the option of 8 characters with a block list of common passwords.
6. Devices and secure configuration
- Only devices approved by [IT lead] may access company data, and each is recorded in our device list.
- Before use, default passwords are changed, auto-run is switched off and unused software, accounts and services are removed.
- Devices lock after [5] minutes and need a password or PIN of at least 6 characters, or a fingerprint or face, to unlock. They lock out, or slow down guessing, after no more than 10 wrong attempts.
- Personal devices may access [company email / named apps] only if they meet sections 5 to 9. If they cannot, they must not be used for work.
- Report a lost or stolen device to [IT lead] immediately so it can be locked or wiped.
7. Software updates
- All software is licensed and supported by its vendor. Unsupported software is removed, or isolated on a network with no internet access.
- Automatic updates are switched on wherever possible.
- Updates the vendor rates critical or high risk, updates fixing a vulnerability with a CVSS v3 score of 7 or above, and updates released without a severity rating are installed within 14 days of release. This includes operating systems, applications, browser extensions and router and firewall firmware.
8. Firewalls and remote working
- Every office internet connection sits behind a firewall or router whose default admin password has been changed.
- Remote admin access to firewalls and routers stays off unless there is a documented need and MFA, or an IP allow list with a strong password, protects it.
- Inbound connections from the internet are blocked by default. Any inbound rule is approved by [IT lead], recorded with the business reason and removed when no longer needed.
- Laptops keep their built-in firewall switched on, especially at home and on public wifi.
9. Malware protection
- Windows and Mac computers, including servers, run [anti-malware product], updated as the vendor recommends and set to stop malware running and block connections to known malicious websites.
- Phones and tablets run only apps on [our approved app list], installed from the official app store and managed through [device management tool].
- Never switch malware protection off. If it blocks something you need, ask [IT lead].
10. Data, email and backups
- Company data is stored only in [approved services]. Do not forward work email or files to personal accounts.
- Laptops and phones use [built-in device encryption].
- Treat unexpected requests for payments, bank detail changes, passwords or MFA codes as suspicious, and check by phone on a known number.
- [IT lead] backs up [named systems] [daily], keeps at least one copy separate from our main systems and tests a restore every [three months].
11. Reporting incidents
- Report straight away to [name, phone and email] if you click a suspicious link, lose a device, notice unusual account activity or send data to the wrong person.
- Nobody is blamed for reporting promptly; delay makes incidents worse.
- [Policy owner] decides next steps, including whether a personal data breach must be reported to the ICO. Where it must, we report without undue delay and, where feasible, within 72 hours of becoming aware of it.
12. Suppliers, review and breaches of this policy
- Suppliers who manage our IT follow sections 4 to 9 for any accounts they use on our behalf.
- Suppliers who handle our data are asked for evidence of their security, such as a Cyber Essentials certificate.
- This policy is reviewed at least every 12 months and after any significant change or incident. Everyone it covers confirms they have read it.
- Breaching this policy may lead to disciplinary action.
For what happens after an incident is reported, use our incident response plan template.
Do you need separate password, BYOD and remote working policies?
Not usually, for a small business. Each of those topics is a section of the template above, and one short policy that everyone reads beats five that nobody does:
| Policy people search for | Where it sits in this template |
|---|---|
| Acceptable use policy | Section 3 |
| Password policy | Section 5, with the detail in our Cyber Essentials password policy guide |
| BYOD (personal device) policy | Section 6 |
| Patch management policy | Section 7 |
| Remote working policy | Section 8 |
| Backup policy | Section 10 |
| Incident reporting policy | Section 11, with our incident response plan template for the response itself |
Split a section into its own document when it grows too long to read in one sitting, when a customer or tender asks for that policy by name, or when you build an ISO 27001 policy set.
Is a policy enough for Cyber Essentials?
No. Cyber Essentials certifies controls, not documents. The IASME question set asks how your devices, accounts and cloud services are actually set up, and Cyber Essentials Plus tests a sample hands-on. A policy keeps the controls in place between assessments, and some answers need a documented process behind them, such as approving new accounts and recording the business reason for each inbound firewall rule.
Two rules matter most. Under the current Danzell question set (v3.3, in force since 27 April 2026), a cloud service without MFA where the service offers it, or a high-risk or critical update not installed within 14 days, fails the whole assessment on its own. Before you apply, use our Cyber Essentials checklist to confirm sections 4 to 9 are true on every in-scope device and cloud service.
How do you put the policy into practice?
- Check the rules against reality. If MFA is not on everywhere yet, fix that first.
- Approve it. A director signs and dates it.
- Brief your team and ask each person to confirm they have read it.
- Diary the review, and update the policy after any new cloud service, IT provider or incident.
When should you move to an ISO 27001 policy set?
When customers ask for ISO 27001, or you need to show security is governed across the business rather than configured on devices. ISO/IEC 27001:2022 requires an information security policy set by top management (clause 5.2), and Annex A control 5.1 expects topic-specific policies that are approved, published, communicated, acknowledged and reviewed, with the controls behind them chosen through your risk assessment. A single small-business policy like this one is a starting point, not a substitute. Our ISO 27001 toolkit lists the documents an ISMS needs.
Why Sovereign Secure?
- We are an IASME-licensed Cyber Essentials certification body, issuing Cyber Essentials and Cyber Essentials Plus certificates.
- We are ISO 27001 certified ourselves, and provide ISO consultancy with certification audits by our partner certification body, MQA International.
- Cyber Essentials packages start at £320 + VAT, with Bronze, Silver and Gold options by organisation size.
What is the next step?
- Download the cyber security policy template (.docx), fill in the placeholders and have a director approve it.
- Test your controls with our free Cyber Essentials readiness check, which scores your readiness, flags automatic fails and lists the fix for every gap.
- Confirm your scope with the free Cyber Essentials scoping questionnaire, then book Cyber Essentials certification from £320 + VAT, or use the form below to ask an assessor.
Last reviewed October 2026 by the Sovereign Secure assessment team.
