Writing a simple security policy for your team

A security policy is the written set of rules your team follows to keep company accounts, devices, and data safe. For a small company it doesn't need legal language or dozens of pages. It needs to be short enough that people read it, clear enough that they know what to do, and specific enough that you can check whether it's being followed.

This guide gives you an outline you can adapt in an hour or two.

What a policy is for

A policy does three jobs:

It tells staff what's expected, so good habits don't depend on who trained them.
It gives you something to point to when a client, insurer, or auditor asks how you handle security. Many security questionnaires ask directly whether you have a written policy and whether staff acknowledge it.
It turns your security plan into daily behavior. The plan is your list of priorities. The policy is the set of rules that delivers them.

The outline

Copy these headings and fill each with three to six short rules. The examples below are starting points. Change them to fit the tools you actually use.

Sections to write

0 of 9 done

Saved in this browser only.

1. Purpose and scope

One paragraph. Who the policy applies to (employees, contractors, interns), which devices and accounts it covers, and who owns it.

Use the company password manager for every work account. Don't save work passwords in your browser or in documents.
Use a unique password for every account. Follow the length guidance in how to create strong passwords.
Two-factor authentication is required on every work account that supports it.
Never share your login. If you need someone else to access something, ask the owner to grant them their own access. See sharing passwords safely for the rare cases where sharing is unavoidable.
Admin accounts are used only for admin tasks.

3. Devices

Work devices must have a screen lock, disk encryption, and automatic updates turned on.
Personal phones used for work email must have a passcode and be enrolled in device management if we use it.
Report a lost or stolen device within the hour, even if you think it will turn up.
Use the guidance in device and Wi-Fi security basics when working away from the office.

4. Handling data

Customer and employee data stays in approved company systems.
Don't forward work files to personal email or personal cloud storage.
Share files with named people, not "anyone with the link," unless the file is meant to be public.
Sensitive data (payment details, ID numbers, health information) is never sent by plain email or chat.

Data privacy basics for your business explains the reasoning behind these rules.

5. Software and AI tools

Only use software the company has approved for work data. Ask before signing up for a new service with a work email.
Don't paste customer data, employee data, or confidential documents into AI tools unless the tool is on the approved list for that use. See AI and your customer data.
Don't install browser extensions on work devices without approval.

6. Payments and money

Any request to change bank details, pay a new account, or make an urgent payment must be confirmed by phone, using a number already on file.
Gift card requests from leadership are always treated as suspicious.
Payments above a set amount need two people to approve.

This section is the one most likely to save you money. Business email compromise explains why.

7. Reporting problems

If you clicked a link, opened an attachment, or entered a password somewhere you're unsure about, tell the security owner straight away.
You won't be punished for reporting a mistake quickly.
Report suspicious emails using the steps in how to recognize phishing.

8. Joining and leaving

New staff get only the access their role needs.
Access is removed on someone's last day. See security steps when someone leaves.
Company devices are returned and wiped.

9. Acknowledgment and review

Everyone reads and acknowledges the policy when they join and when it changes.
The owner reviews it at least once a year.

Writing tips

Write rules as actions. "Lock your screen when you step away" beats "maintain workstation confidentiality."
Name the tools. "Use 1Password" or "use Bitwarden" is clearer than "use an approved credential vault."
Explain the why in one line, where it isn't obvious. People follow rules they understand.
Keep exceptions explicit. If the owner can approve an exception, say so and say how.
Match the policy to reality. Don't require something you haven't set up. A policy that says "all devices are managed" when they aren't is worse than no policy, because it's a false statement you may repeat to a client or insurer.

Be accurate when you describe your policy to others

Insurance applications and client questionnaires often ask whether controls are in place. If your answer doesn't match what you actually do, it can cause problems later, including disputes over a claim. Write the policy you follow, then improve both together.

Rolling it out

Draft it using the outline above.

Check it against reality. For each rule, confirm the tool or setting exists. Fix the gap or remove the rule.

Walk the team through it in a short meeting. Focus on the payment rule and the reporting rule.

Collect acknowledgments. A signed form, an e-signature, or a tick-box in your HR system all work.

Store it where people can find it, such as your shared drive or intranet, and add it to onboarding.

Frequently asked questions

Should we buy a policy template pack?

Templates can help with structure. The SANS Institute publishes free security policy templates. The risk is adopting rules written for a large enterprise that you can't follow. Use a template as a menu, not a script.

Do contractors need to follow it?

If they use your accounts or handle your data, yes. Add a line to contractor agreements requiring them to follow it, or to follow an equivalent policy of their own.

What about a separate acceptable use policy?

Larger companies often split these into several documents. For a small team, one combined policy is easier to read and maintain.