Most growing companies reach the point where a customer, an investor or a supplier asks: do you have an information security policy? For many the honest answer is an uneasy “partly”. This guide sets out what such a policy is, what it should cover, and how to introduce one that works in practice without turning into a forty-page ISO document nobody reads. There is a checklist at the end you can run through straight away.
An information security policy is the overarching document describing how your company protects its information: customer data, trade secrets, systems and the personal data you are responsible for. It is the umbrella that the more concrete routines hang under.
What it should cover
A useful policy for a smaller company does not need to be long, but it does need to address six things: the value and classification of information (what is sensitive?), roles and responsibility (who owns security?), access and permissions, devices and passwords, incident handling, and suppliers and third parties. The point is not completeness on paper. It is that every employee knows what is expected.
Note the difference from a shorter security policy. The information security policy is the strategic frame, while the everyday working policy can be kept to a single page. We have written a separate guide to that short version in the one-page security policy.
The structure to start from
A template that holds up follows a simple structure: purpose and scope, definitions, who is responsible, the six areas above one by one, and a line on how and when the policy is reviewed. Write it in plain language. A policy that changes behaviour is worth more than one that impresses an auditor.
Checklist: the things to confirm
Work through the points below. If you can answer yes to all of them you have a working foundation. Any no is a priority.
Information security: a quick check
The point about incidents assumes you know exactly what happens in the first few hours. We break that process down step by step in incident response in 72 hours.
Introducing it without it becoming paperwork
Get management behind it, walk through it at a staff meeting (ten minutes will do), ask everyone to confirm they have read it, and put it where people will find it. Set a calendar reminder for the annual review. A policy only becomes real when it shows up in the working day.
Ready to see where you stand?
A position per area and a concrete picture of your gaps in information security and compliance.
