How to Write a Cybersecurity Policy for Your Company

A customer sends over a vendor security questionnaire. Question 1: “Please provide a copy of your information security policy.” Or your cyber insurance renewal asks whether you have written security policies. Or a new employee asks whether they can use their personal laptop for work, and nobody knows the answer.

That’s usually when a business realizes it needs a cybersecurity policy. The good news: you don’t need a 90-page binder. A small business can cover the essentials in a handful of short, clear documents. This guide gives you an outline of what to write first, what each policy should say and how to get people to follow it.

What a cybersecurity policy is, and why it matters

A cybersecurity policy is a written set of rules for how your company protects its systems and data. It answers practical questions: Who can access what? How do we handle passwords? What happens when someone clicks a phishing link? Who’s in charge?

A good policy does 3 jobs:

• Sets expectations. Employees know the rules before something goes wrong.
• Proves diligence. Customers, auditors, insurers and regulators often ask to see it.
• Guides decisions. When a new tool or situation comes up, the policy gives a default answer.

NIST’s Cybersecurity Framework 2.0 added a Govern function in 2024 that covers exactly this: setting your cybersecurity strategy, expectations and policy. NIST’s Small Business Quick-Start Guide for CSF 2.0 is a free, plain-language starting point.

Key takeaway: A short policy people actually read beats a long template nobody opens. Write rules your team can follow on a busy Tuesday.

Do you legally need a written security policy?

For many businesses, it’s a good practice rather than a legal requirement. But some laws do require a written program. Examples include:

• FTC Safeguards Rule. Under the Gramm-Leach-Bliley Act, non-bank “financial institutions” under FTC jurisdiction, such as mortgage brokers, tax preparation firms, finance companies, collection agencies and some financial advisors, must keep a written information security program. It must include a Qualified Individual who oversees it, a written risk assessment, an incident response plan and annual reports to leadership. Since May 2024, covered businesses must also notify the FTC within 30 days of discovering a breach affecting 500 or more consumers. Businesses with data on fewer than 5,000 consumers are exempt from some, not all, provisions.
• Massachusetts 201 CMR 17.00. Effective March 1, 2010, any person that owns or licenses personal information about a Massachusetts resident must maintain a written comprehensive information security program, even if the business is based elsewhere.
• HIPAA Security Rule. Covered entities and business associates must maintain written policies and procedures for protecting electronic health information.
• PCI DSS. Merchants that accept cards must maintain security policies as part of compliance. See our PCI DSS guide.

Contracts can require it too. Enterprise customers, SOC 2 audits and cyber insurers commonly ask for written policies. Our guide to cyber insurance requirements covers what insurers typically look for. This is not legal advice. Check with counsel about the rules that apply to your business and your states.

The core policies to write first

Start with a short master policy, then add these 5 core policies. Together they cover most of what small and midsize businesses need.

1. Master information security policy

Keep this to 1 or 2 pages:

• Purpose: Why the company protects information.
• Scope: Who and what it covers, including employees, contractors, devices and cloud services.
• Owner: A named person responsible for security, even if they also do other jobs.
• Roles: Who approves access, who manages IT, who handles incidents.
• Review cycle: At least once a year and after major changes.
• Enforcement: What happens when people don’t follow it.

2. Acceptable use policy

Spell out what’s allowed on company systems: personal use limits, prohibited sites and software, no installing unapproved apps and rules for company email. Include AI tools: which ones are approved and what data must never be pasted into them. Our guide on how to write an AI acceptable use policy goes deeper.

3. Password and access control policy

• Require multi-factor authentication on email, banking, remote access and admin accounts. Most major email, cloud and banking services support it.
• Require a company password manager and unique passwords. Shared vaults make it easy to hand off credentials safely.
• Give people only the access they need, and review access at least every 6 to 12 months.
• Remove access promptly when people leave. Pair this with an employee offboarding IT security checklist.

4. Data handling and backup policy

• Define 2 or 3 data categories, such as public, internal and confidential.
• Say where confidential data may be stored and how it may be shared.
• Set retention periods and secure disposal rules.
• Require regular backups, with at least one copy offline or immutable and periodic restore tests. See how to back up business data.

5. Remote work and device policy

• Company devices must have screen locks, encryption, updates and endpoint protection.
• State whether personal devices can access company data and under what conditions.
• Require secure home Wi-Fi and avoid public Wi-Fi without protection.
• Report lost or stolen devices within a set time, such as 24 hours.

6. Incident reporting and response policy

This one is short for staff: “If you suspect a problem, report it immediately to this person, by this method. Don’t try to fix it yourself, and you won’t be punished for reporting honestly.” Keep the detailed steps in a separate incident response plan for the response team.

How to write it: a step-by-step process

1. Pick an owner. One person drives the work and keeps it current.
2. List your data and systems. What sensitive data do you hold, and where does it live? Email, cloud storage, accounting, CRM, payment systems.
3. Check your obligations. Laws, contracts, insurance requirements and frameworks you follow.
4. Start from a framework, not a blank page. NIST CSF 2.0 and its small business quick-start guide give you structure. Free templates from reputable sources can help, but edit them heavily.
5. Write in plain language. Use “must” for requirements and “should” for recommendations. Short sentences. Real examples.
6. Match policy to reality. Don’t require something you can’t enforce. If you say “MFA everywhere,” turn it on everywhere.
7. Get leadership sign-off. Policies need visible support from the top.
8. Publish and collect acknowledgments. Every employee signs or clicks to confirm they’ve read it.
9. Train. Walk through the key rules in onboarding and in regular security awareness training.
10. Review yearly. And after incidents, new tools, new laws or big changes.

How to get employees to actually follow it

Writing the policy is the easy part. Adoption is where most small businesses struggle. What works:

• Keep it short. Give employees a 1-page summary of the rules that affect them most.
• Explain the why. “We require MFA because most account takeovers start with a stolen password” lands better than “Policy 4.2 requires MFA.”
• Make the secure way the easy way. A password manager, single sign-on and automatic updates do more than any rule.
• Use technology to enforce rules. Device management, conditional access and email filtering turn policy into settings.
• Reward reporting. Thank people who report phishing or mistakes. Fear makes people hide problems.
• Lead by example. Owners and managers follow the same rules, including MFA.
• Revisit it regularly. A 10-minute refresher each quarter keeps it fresh.

Where to start this week

1. Name the policy owner.
2. Write the 1-page master policy.
3. Turn on MFA for email and banking if it isn’t already, and write it into the password policy.
4. Write the incident reporting rule and share it with everyone.
5. Schedule the remaining policies over the next 30 to 60 days.

For a practical list of controls to pair with your policies, see our small business cybersecurity checklist. If you want to align with a formal framework, NIST CSF 2.0 gives you the full structure.

Conclusion

A cybersecurity policy doesn’t need to be long or legalistic. Start with a short master policy and 5 core policies covering acceptable use, access, data, devices and incident reporting. Write them in plain language, match them to what you actually do, train your team and review them every year. That small investment answers customer questionnaires, satisfies many insurers and regulators and, most importantly, helps your team make the right call when it counts.

Sources

• NIST SP 1300: CSF 2.0 Small Business Quick-Start Guide — Govern function and small business starting points
• NIST Cybersecurity Framework 2.0 — framework structure including the Govern function
• FTC: FTC Safeguards Rule, what your business needs to know — covered businesses, written program elements, 500-consumer breach notice, 5,000-consumer exemption
• Massachusetts 201 CMR 17.00: Standards for the protection of personal information — written information security program requirement