A security policy does not have to run to twenty pages. For most small and mid-sized companies, a document nobody reads is worse than no document at all, because it creates a sense of safety that is not there.
What you need is a policy concrete enough that people understand what is expected of them, and short enough that they actually read it.
What it should cover
A one-page security policy for a company of 20 to 50 people should deal with six things.
Passwords and access: every account has its own strong password. A password manager is used. Multi-factor authentication is mandatory for email, business systems and cloud services.
Devices: company laptops and phones have screen lock enabled and encrypted drives. Personal devices used for work are approved by [responsible person].
Networks: open wifi in cafés and hotels is not used for sensitive work without a VPN. Home networks should run WPA2 or WPA3.
Email and phishing: do not click unknown links or attachments. If in any doubt, ask [responsible person] before opening. Never send sensitive information by unencrypted email.
Reporting incidents: if something looks wrong, a stolen device, a login you do not recognise, a phishing link someone clicked, report it immediately to [responsible person]. There is no shame in reporting. There is real damage in staying quiet. What the first 72 hours should look like is set out in our incident response flow.
Responsibility: every employee is responsible for following this policy. Breaches are handled under the company’s disciplinary procedures.
The template: one page that covers what matters
[Company name]: information security policy
Version: 1.0 | Date: [date] | Owner: [name or role]
We protect the availability, integrity and confidentiality of our information and our systems. That is everyone's job.
- Passwords and access
- A unique password for every account. A password manager is used. MFA is mandatory for email and business systems.
- Devices
- Screen lock and encryption on every device. A lost or stolen device is reported immediately.
- Networks
- Avoid open wifi for sensitive work. Use a VPN where needed.
- Treat unknown senders and attachments with suspicion. If in doubt, ask before you click.
- Incidents
- Anything suspicious goes straight to [name, contact details]. Move fast: every hour counts.
- Responsibility
- The policy applies to all employees, consultants and contractors with access to our systems.
Questions? Contact [name].
Putting it in place
Hand the policy out at onboarding and ask everyone to sign that they have read it. Walk through it at a staff meeting, five minutes is enough. Update it when something changes and tell people that you have.
That is the whole job. A policy everyone knows and understands does more good than an ISO 27001 document living in a folder nobody opens.
Want to see which of the basic documents you already have, and which are missing? Take our Compliance Health Check.
