In this guide · 8 sections
- 01What a small business IT policy should (and shouldn't) be
- 02The template, section 1: accounts and passwords
- 03Sections 2 and 3: devices, data and email
- 04Sections 4 and 5: AI tools and incident reporting
- 05How the template maps to Cyber Essentials
- 06Rolling it out: acknowledgement and yearly review
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Keep it to five sections: accounts and passwords, devices, data and email, AI tools, and reporting incidents. Write each rule as a clear instruction staff can follow, map it to the Cyber Essentials areas if you plan to certify, get signed acknowledgement, and review it yearly.
What a small business IT policy should (and shouldn't) be
A policy is a promise about how the business works. If it says "all laptops are encrypted" and three aren't, it is worse than no policy, because it shows you knew the rule and didn't follow it. So write only what you do, or will do by a set date.
A good small business policy
- Three pages or less, in plain English
- Each rule is an instruction: "Turn on MFA", "Report within one hour"
- Names who is responsible and who to contact
- Matches what your systems actually enforce
- Signed by every staff member and reviewed yearly
Red flags
- Copied from a bank or multinational, 30 pages long
- Vague words like "appropriate" and "where possible" everywhere
- Rules nobody can check, such as "never click suspicious links" with no reporting route
- No owner, no date, no version number
- Never shown to staff after onboarding
The template, section 1: accounts and passwords
Use the wording below as a starting point. Replace the bracketed parts.
- Each person has their own account for email and business systems. Shared logins are not allowed, except [list approved shared mailboxes].
- Multi-factor authentication (MFA) must be on for email, cloud storage, banking and any admin account. Use an authenticator app or passkey where offered.
- Use the company password manager [name] for all work passwords. Passwords must be unique per site and at least 12 characters, or generated by the password manager.
- Never reuse a work password on a personal site, and never share passwords by email, WhatsApp or text.
- Admin rights are only for [named roles] and are used only for admin tasks.
- When someone leaves, [owner] disables their accounts on their last day and changes any shared passwords they knew.
Our guides to setting up MFA and choosing a password manager cover the technical side.
Sections 2 and 3: devices, data and email
Section 2: devices
- Work is done on company devices, or on personal devices enrolled in [device management tool] under our BYOD rules.
- Devices must have screen lock, disk encryption, automatic updates and the approved antivirus turned on. Don't disable them.
- Don't install software or browser extensions that [owner] hasn't approved.
- Report a lost or stolen device to [owner] immediately so it can be locked or wiped.
- Return all company devices and data on your last day.
If staff use their own phones for work email, read our BYOD policy and MDM guide before writing this section.
Section 3: data and email
- Store work files in [OneDrive/SharePoint/Google Drive], not on desktops or USB drives.
- Share files with outsiders using links with expiry dates, not public "anyone with the link" access.
- Customer personal data is accessed only when needed for your job and never copied to personal accounts.
- Verify any request to change bank details or make an urgent payment by calling a known number, not replying to the email.
- Delete or archive data according to [retention schedule]; don't keep customer data "just in case".
Sections 4 and 5: AI tools and incident reporting
Section 4: AI tools
- Only use AI tools on the approved list: [tools, plan type]. Use your work account, not a personal one.
- Don't paste customer personal data, passwords, contracts or confidential figures into AI tools unless the tool is approved for that data.
- Check AI output before sending or publishing it. You remain responsible for what you send.
- Recording meetings with AI note-takers requires telling participants first.
For a fuller AI section, use our ChatGPT at work policy guide, and for meeting recorders, our guide to AI voice recorders and PDPA consent.
Section 5: reporting incidents
- Report anything suspicious to [name, phone, WhatsApp] within one hour: a clicked phishing link, unexpected MFA prompt, lost device, misdirected email with personal data, or a strange payment request.
- Don't try to investigate or delete evidence yourself. Disconnect the device from Wi-Fi if told to.
- You won't be blamed for reporting a mistake quickly. Hiding one is a disciplinary matter.
- [Owner] decides on next steps, including whether the PDPC or customers need to be notified.
How the template maps to Cyber Essentials
CSA's Cyber Essentials mark groups its measures into five categories. A policy alone doesn't earn the mark, but assessors look for evidence that rules exist and are followed. Here is where each template section helps:
| Cyber Essentials category | Covered by template section | Evidence to keep |
|---|---|---|
| Assets (people, hardware, software, data) | 2 Devices, 3 Data | Asset list, staff awareness records |
| Secure/Protect (malware, access, configuration) | 1 Accounts, 2 Devices | MFA report, admin list, antivirus console |
| Update | 2 Devices | Update status report from device management |
| Backup | 3 Data (add a backup line) | Backup schedule and a recent restore test |
| Respond | 5 Incidents | Incident contact list and response plan |
Backup is usually handled by IT rather than staff, so it may sit in a separate one-page IT procedure rather than the staff policy. If you plan to certify, our Cyber Essentials checklist lists each requirement in plain English. If you also follow the US NIST Cybersecurity Framework 2.0, its six functions (Govern, Identify, Protect, Detect, Respond, Recover) cover the same ground; see NIST's framework page.
Rolling it out: acknowledgement and yearly review
A policy only works if staff know it exists. Keep the rollout simple.
Check every rule against reality
Confirm MFA, encryption, updates and the password manager are actually in place, or set a date for each.
Add version, owner and date
Put "Version 1.0, owner [name], effective [date], next review [date]" at the top.
Walk staff through it
A 20-minute session works better than an email. Explain why each rule exists with a real example.
Collect signed acknowledgement
A simple form: "I have read and will follow the IT and Security Policy version 1.0", name, date. Keep it with HR records.
Add it to onboarding and offboarding
New staff sign on day one. Leavers' accounts and devices are handled as section 1 and 2 say.
Review yearly or after an incident
Update tools, names and rules; re-collect acknowledgement for material changes.
Do it yourself or get help?
Most owners can adapt this template in an afternoon. The harder part is making sure the technology matches the words, and that staff actually understand the rules.
Our Security Awareness Training (S$390) includes a tailored policy, a staff session and acknowledgement tracking. If you are aiming for the CSA mark, our Cyber Essentials Readiness package (from S$990) closes the technical gaps and prepares the evidence an assessor will ask for.
Frequently asked questions
There is no general law requiring a document by that name, but a written policy is how you show staff and assessors what the rules are. CSA's Cyber Essentials expects evidence of controls such as access management and incident response, and customers or insurers increasingly ask for it. Three clear pages is enough for most SMEs.
For a small business: accounts and passwords (MFA, password manager, no sharing), devices (encryption, updates, approved software), data and email (where files live, sharing, payment verification), AI tools (approved tools and what not to paste), and incident reporting (who to tell, how fast). Add owner, version and review date.
No. Cyber Essentials is assessed on whether the measures are actually in place, verified by an independent assessor reviewing your self-assessment and evidence. A policy helps show intent and covers some requirements, such as staff awareness and incident response, but you also need MFA, updates, backups and the other controls working.
Review it at least once a year, and after any incident, new system or significant change such as adopting AI tools or moving to a new email platform. Update names, tools and contacts, check every rule still matches reality, and ask staff to re-acknowledge it when the rules change materially.
Yes. A signed or electronic acknowledgement shows each person received and understood the rules, which matters if a rule is broken later. Keep it simple: policy name, version, date and signature. Collect it at onboarding and again after significant updates, and store it with HR records.