IT Security Policy Template for Small Business: 10 Rules
By Nemanja Vukmirović, Lizzard Solutions. Last updated 12 November 2026.
Most small businesses have security rules. They just live in one person’s head. Everyone knows “don’t share the Wi-Fi password”, but nobody knows who approves admin access, how fast a lost laptop must be reported, or which files may go into a personal Dropbox.
This IT security policy template turns those unwritten rules into a two to four page document your team can actually read. It has ten sections with ready-to-edit wording, an owner for each rule, and a rollout plan you can finish in a week.
TL;DR
- An IT security policy is a short written set of rules for how your company uses and protects devices, accounts and data.
- For a small business, ten sections are enough: scope, roles, accounts and passwords, devices, data, email, remote work, backups, incidents and onboarding/offboarding.
- A policy only works if each rule has an owner, people sign it, and you review it once a year.
What Is an IT Security Policy?
An IT security policy is a written document that sets the rules for how a company’s staff use and protect its devices, accounts, networks and data, who is responsible for each rule, and what happens when a rule is broken. For a small business it should be short, specific and enforceable, not a copy of a corporate manual.
It is different from your other security documents. The policy says what the rules are. Guides such as our multi-factor authentication setup guide explain how to apply them. The incident response plan template says what to do when something already went wrong.
| Document | Answers | Who reads it |
|---|---|---|
| IT security policy | What are the rules? | Everyone on the team |
| Procedures and how-to guides | How do I follow the rule? | People doing the task |
| Incident response plan | What do we do during an incident? | Owner, IT partner, key staff |
Key takeaway
If a rule can’t be checked, it isn’t a rule yet. Write “MFA is on for every work account”, not “use strong security”.
Action for today: list the rules people already follow informally. That list is your first draft.
Why a Small Business Needs a Written Security Policy
Free guidance from government bodies keeps coming back to the same basics: strong sign-in, updates, backups, and staff who know what to do. The UK NCSC Small Business Guide and CISA Cyber Essentials both frame security as habits for the whole team, not just technology. A written policy is how you turn those habits into something new hires learn on day one.
There are practical reasons too:
- Clients ask for it. Larger customers and partners often send security questionnaires before signing. A policy lets you answer in minutes.
- Insurance and tenders. Cyber insurance forms and public tenders often ask whether you have documented security rules.
- Fewer arguments. When the rule is written, “can I use my own laptop?” has an answer that doesn’t depend on who you ask.
- Faster offboarding. When someone leaves, the policy already says which access is removed and when.
Action for today: find the last security question a client or partner asked you. Make sure your policy will answer it.
The IT Security Policy Template: 10 Sections
Copy each block into a document, replace the bracketed parts, and delete anything that doesn’t apply. Keep the wording plain. If a rule needs more than three lines, move the detail into a separate how-to guide.
1. Purpose and scope
Template: Purpose and scope
☐ This policy applies to all employees, contractors and interns of [Company] who use company devices, accounts or data.
☐ It covers laptops, phones, email, cloud apps, the website and any personal device used for work.
☐ Version [1.0], approved by [Owner] on [date], next review [date + 12 months].
2. Roles and responsibilities
Template: Roles
☐ [Owner/manager] approves this policy and any exceptions in writing.
☐ [IT contact or IT partner] manages accounts, devices, updates and backups.
☐ Every staff member follows the policy and reports problems within [1 hour].
3. Accounts, passwords and MFA
Template: Accounts
☐ Every person has their own account. Shared logins are not allowed.
☐ Passwords are stored in the company password manager and are unique per service.
☐ Multi-factor authentication is on for email, cloud storage, banking, the website admin and social media.
☐ Admin rights are given only to [named roles] and reviewed every [3 months].
For the practical setup, see our password manager guide for small business teams.
4. Devices
Template: Devices
☐ Work devices have a screen lock, disk encryption and automatic updates turned on.
☐ Lost or stolen devices are reported to [IT contact] immediately, the same day at the latest.
☐ Personal devices may access [email/chat only] and must have a screen lock and current updates.
☐ Software is installed only from official stores or with [IT contact] approval.
5. Data handling
Template: Data
☐ Client and personal data is stored only in [approved systems, e.g. Google Drive / Microsoft 365].
☐ Personal storage, USB drives and private email are not used for company data.
☐ Sensitive files are shared with named people, not with “anyone with the link”.
☐ Data is kept only as long as needed, following [retention rule].
6. Email, phishing and payments
Template: Email and payments
☐ Don’t open unexpected attachments or log in through links in email. Go to the site directly.
☐ Any change to bank details or an urgent payment request is confirmed by phone on a known number.
☐ Suspicious messages are forwarded to [IT contact] and then deleted.
7. Remote work and Wi-Fi
Template: Remote work
☐ Work from public Wi-Fi only through [VPN / phone hotspot].
☐ The office Wi-Fi uses WPA2 or WPA3 with a strong password. Guests use a separate guest network.
☐ Screens are locked whenever you leave the device, at home or in the office.
8. Backups
Template: Backups
☐ Critical data is backed up automatically following the 3-2-1 rule.
☐ [IT contact] tests a restore at least every [3 months] and records the result.
Our 3-2-1 data backup guide explains how to set this up and test it.
9. Incident reporting
Template: Incidents
☐ Anyone who suspects a breach, a virus or a lost device reports it to [IT contact] at [phone] right away.
☐ Nobody is blamed for reporting early. Hiding a mistake is the only thing that breaks this rule.
☐ Incidents are handled following the company incident response plan.
10. Onboarding, offboarding and exceptions
Template: People changes
☐ New staff read and sign this policy before receiving access.
☐ When someone leaves, all access is removed on their last day, following the offboarding checklist.
☐ Exceptions are approved in writing by [Owner], with an end date.
The employee offboarding IT checklist lists every account to close when someone leaves.
Action for today: fill in the brackets for sections 1 to 3. Those three already cover the most common risks.
Who Owns Each Rule?
A policy without owners becomes a PDF nobody opens. Give every section one name.
| Section | Owner | How you check it |
|---|---|---|
| Accounts, passwords, MFA | IT contact | Admin console shows MFA on for every user |
| Devices | IT contact | Device list with encryption and update status |
| Data handling | Owner/manager | Sharing settings reviewed every quarter |
| Email and payments | Everyone; finance confirms | Payment changes logged with a callback |
| Backups | IT contact | Restore test date and result recorded |
| Onboarding and offboarding | Owner/manager | Signed policy and closed accounts per person |
Action for today: write a name next to every row. If one person owns everything, that’s fine for a small team, but write it down.
How to Roll Out the Policy in One Week
- Day 1: fill in the template and remove what doesn’t apply.
- Day 2: check that the technology matches the words. If the policy says MFA is on, confirm it really is.
- Day 3: walk the team through it in a 30-minute meeting. Explain the reason behind each rule.
- Day 4: collect signatures or a written “I’ve read it” from each person.
- Day 5: store it where everyone can find it and set a calendar reminder for the yearly review.
Common mistake
Copying a 40-page enterprise policy. Nobody reads it, and you can’t prove you follow it. Start short and add rules only after a real need.
If you want deeper material, SANS security policy templates cover individual topics such as acceptable use and passwords, and the NIST Small Business Cybersecurity Corner has free guides written for small firms. Use them to expand single sections, not to replace this short version.
Your website is part of your security too. Run the free website security check to see whether HTTPS and security headers match what your policy promises. For the wider picture, read our cybersecurity guide for small business.
Action for today: book the 30-minute team meeting for this week.
IT Security Policy Template: FAQ
What should an IT security policy include?
A small business IT security policy should include its scope, roles, rules for accounts, passwords and MFA, device security, data handling, email and payment checks, remote work, backups, incident reporting, and onboarding and offboarding. Each rule needs an owner and a way to check it, plus a yearly review date.
How long should a small business security policy be?
Two to four pages is enough for most small businesses. The goal is a document every employee reads and remembers. Put step-by-step instructions, such as how to set up MFA or restore a backup, into separate short guides and link to them from the policy instead of making it longer.
How often should I update my IT security policy?
Review it at least once a year, and also after any security incident, a new major system such as a new email provider or CRM, or a big change in how the team works, like moving to remote work. Update the version number and date so everyone knows which version applies.
Do employees need to sign the security policy?
It is good practice. A signature or written confirmation shows each person has read the rules, which helps with client questionnaires and insurance forms and makes expectations clear. Ask new staff to sign before they receive access, and ask everyone again after a major update.
Want a security policy that matches your real setup?
We can tailor this template to your tools, check that MFA, backups and devices actually follow it, and train your team.
Book a free consultation