In brief: A small-business cyber security policy should identify who is responsible, the systems and information that need protection, the rules people must follow, and what to do when something goes wrong. Keep it practical, assign each task to an owner, and review it whenever your systems, suppliers or working practices change.
What should a cyber security policy for a small business include?
A cyber security policy for a small business should set out who is responsible for protecting the business’s systems and information, the rules people must follow, and what to do when something looks wrong. At a minimum, it should cover important accounts, devices and software, backups, staff behaviour, access to information, and incident reporting.
A policy is useful only if people can follow it. Keep it short, specific to the way your business works, and clear about who owns each task. The National Cyber Security Centre’s small-organisations guide advises businesses to focus on securing email and important accounts, protecting devices, backing up data and spotting cyber attacks. Those are sensible starting points for a practical policy.
For an owner-managed business, this means turning good intentions into agreed working habits. The policy should tell staff what they need to do, who can approve exceptions, and where to report a problem. It should then be reviewed when your systems, suppliers or ways of working change. Our guide to cyber security for UK SMEs provides a broader introduction to the threats and controls involved.
Why does a small business need a cyber security policy?
Small businesses rely on email, cloud services, bank accounts, websites and customer information just as larger organisations do. A policy gives everyone a shared way of protecting those assets and responding quickly when an incident occurs.
The NCSC says cyber security should not be left with one person. This matters where responsibilities are spread between owners, employees, outsourced IT support and suppliers. Without a written policy, important tasks can be assumed rather than completed.
A policy is also one part of good information governance. If your business processes personal data, the Information Commissioner’s Office guidance on data security explains that the UK GDPR security principle requires appropriate technical and organisational measures. The ICO’s guidance includes having an information security policy or equivalent, implementing it, and reviewing it regularly. The right controls depend on your circumstances and the risks involved.
Who should own the policy?
A director or business owner should approve the policy and name a person responsible for keeping it current. That person does not need to perform every technical task, but they do need the authority to make sure each task has an owner and is completed.
List the people or suppliers responsible for core areas. For example, one person may manage user access, an IT provider may apply updates, and a director may decide whether an incident needs to be escalated. Include a simple contact route for staff who spot a suspicious email, unfamiliar login alert or unexpected payment.
Do not make the policy an IT document that nobody else reads. It should state what the business expects from everyone who uses its systems.
Which accounts and access rules should be in the policy?
Start with the accounts that could cause the greatest disruption or expose important information if someone gained access. These may include banking and finance, HR and payroll, social media, online storage, the company website and domain hosting, point-of-sale software, and email.
For each important account, record the business owner, who is allowed access and how access is protected. The NCSC recommends enabling passkeys where they are available for business-critical accounts. Where a service does not support passkeys, use a strong, unique password and two-step verification.
Your policy should also explain how access is removed when a member of staff, contractor or supplier no longer needs it. Review shared accounts particularly carefully. A simple access list that someone checks is often more useful than a complex rule that nobody follows.
How should the policy cover devices, software and remote working?
Set clear rules for the devices and software used for business work. State whether staff may use personal devices, who can install software, how updates are handled, and what to do if a device is lost, stolen or behaving unexpectedly.
Make the policy match reality. If staff work from home, travel or use cloud tools, cover those situations rather than assuming all work happens in one office. The GOV.UK cyber security guidance for business brings together practical advice on basic controls, secure home and remote working, staff training and incident response.
Avoid promising controls the business has not put in place. Record the approved devices, systems and remote-working rules that already apply, then assign an owner and target date to any improvement still needed.
What should the policy say about backups?
Identify the information the business needs to keep operating and how it will be backed up. This may include websites, emails, invoicing records, documents, presentations, contacts and customer information.
The policy should say where backups are held, who checks them, and how the business knows it can restore what it needs. The NCSC advises organisations to know how to restore backups and check that they contain important data. It also advises protecting online backups with two-step verification and, where appropriate, considering both online and separate storage.
Making a backup is not the end of the task. A backup that cannot be found or restored when needed may not help the business recover.
How should staff report suspicious activity?
Give staff a short, clear reporting process. They should know where to send a suspicious email, who to call if an account may be compromised, and what to do if they notice an unfamiliar login, unusual device behaviour or an unauthorised payment.
The NCSC lists warning signs such as unusual emails, messages sent from your account that you did not send, unrecognised login alerts, devices behaving slowly or unexpectedly, and unauthorised payments. Its guidance says a cyber attack plan should define who does what and when if something goes wrong.
Keep this part of the policy practical. Staff do not need to decide whether something is definitely an attack before reporting it. They need to know that raising a concern promptly is the right action. Put the reporting email address, phone number and out-of-hours route directly in the policy, and test that those routes still work.
How should the policy deal with personal data?
Where your systems hold personal data, link cyber security decisions to data-protection responsibilities. According to the ICO, appropriate security measures must take account of the nature of the processing and the risk to people’s rights and freedoms. Our guide to business compliance for UK SMEs explains the wider governance context.
The ICO says measures should support confidentiality, integrity and availability, and should enable access to personal data to be restored in a timely way after a physical or technical incident. It also says organisations should test the effectiveness of their measures and improve them where necessary. These points make a policy more than a list of passwords and software settings.
If a supplier processes personal data for you, include how you assess that supplier’s security responsibilities, who manages the relationship, and where staff can find the business’s data-protection contact.
How often should you review a cyber security policy?
Review the policy on a regular schedule and whenever there is a meaningful change. That could include introducing a new system, changing an IT supplier, moving to remote working, taking on a new type of customer data or learning from an incident.
The ICO recommends regularly reviewing information security policies and measures and improving them where needed. A review does not need to be lengthy. Confirm that account owners, access lists, backup arrangements, supplier contacts and reporting routes are still correct.
Clear ownership and routine review are part of effective business management services: they turn a policy from a document into a dependable part of everyday operations.
A simple cyber security policy checklist
Before approving the policy, check that it answers these questions:
- Which systems, accounts and data matter most to the business?
- Who owns each key task, and who covers it if they are unavailable?
- How are important accounts protected and access removed when it is no longer needed?
- What must staff do with devices, software, passwords, passkeys and two-step verification?
- What is backed up, where is it held, and how is restoration checked?
- How does someone report a suspected incident, and who decides the next step?
- When will the policy be reviewed, and what events trigger an earlier review?
Frequently asked questions
Does a small business have to have a cyber security policy?
A standalone cyber security policy is not a substitute for the controls your business needs. However, if your business processes personal data, the ICO says you need appropriate technical and organisational measures to protect it. A clear policy can help show how responsibilities and working practices are organised.
What is the difference between a cyber security policy and an incident response plan?
A cyber security policy sets the everyday rules and responsibilities for protecting systems and information. An incident response plan explains what people should do when a suspected or confirmed incident occurs. Your policy should point people to the plan and name the people who will take action.
Should our policy require two-step verification?
For business-critical accounts that still use passwords, the NCSC recommends using a strong, unique password and two-step verification. Where passkeys are available, the NCSC recommends enabling them for important accounts. Record which accounts are business-critical and who is responsible for checking their protection.
What should we back up?
Back up the data your business needs to operate. This may include your website, emails, invoicing records, documents, presentations, contacts and customer information. Your own list should reflect what the business would need to restore after an incident.
How often should staff receive cyber security guidance?
Give staff guidance when they join, when working practices or systems change, and when a real issue shows that a reminder is needed. Set a regular refresher schedule appropriate to the business, and make sure the policy explains how staff report suspicious activity and where they can find the current instructions.
Turn the policy into tested behaviour
- Are important accounts protected with strong authentication and controlled access?
- Are backups protected, and has recovery been tested?
- Does everyone know how to report a suspicious message or incident?
Record the evidence, accountable owner and review date. Where a decision affects legal or regulatory duties, obtain suitably qualified advice for your business’s circumstances.
Guidance reviewed October 2026. This article provides general information and does not replace legal, data-protection or cyber security advice for your circumstances.
If you need an objective view of the risks, opportunities and priorities in your business, explore our Business Review service.
