Most searches for a cyber security policy for small business end at a forty-page corporate document nobody will read or a two-paragraph sample that says nothing enforceable. This guide sits between the two. It explains what each section of a policy is for, gives a concrete minimum for a business of 10 to 100 people, and ships an original editable template organized around the six functions of the NIST Cybersecurity Framework 2.0 and the essential cyber hygiene safeguards of CIS Controls v8 Implementation Group 1.
Download (original NetSys template, no registration):
- Download the cybersecurity policy template (Word, .docx): 20 sections with bracketed fill-ins, a guidance note under each section, an approval and review record, a retention schedule, an exception register and a framework cross-reference.
The template names the policy owner as the IT director or a more senior executive accountable for IT. It is written as a policy (what the company requires), not a procedure manual (how IT does it), and it pairs with the acceptable use policy template that tells staff what they may and may not do.
What is a cybersecurity policy?
A cybersecurity policy is the document in which a company's leadership states its security requirements and assigns responsibility for meeting them. It is deliberately different from three things it is often confused with. A standard sets a specific measurable requirement (patch within 14 days). A procedure describes how a task is done (the offboarding checklist). A control is the setting or activity that does the work (the device management rule that enforces encryption). The policy is the layer that makes the other three mandatory, names who owns them, and gives the company something to hold people and vendors to.
For a small business the useful test is this: if an insurer, a client's security questionnaire or a regulator asked "show me where this is required," the policy is the page you would point to. If the requirement exists only in an engineer's head or a vendor's console, it is not yet a policy.
Who needs a cybersecurity policy?
Any business that holds other people's information, buys cyber insurance, answers client security questionnaires or works in a regulated field. In practice that is nearly every business with more than a handful of staff. The pressure usually arrives from one of these directions:
| Driver | What it asks for | Where the template answers it |
|---|---|---|
| Cyber insurance application | Written policies, MFA, EDR, backups, training and an incident plan, with answers that must match reality | Sections 4, 5, 9, 13 and 14, plus the evidence notes under each |
| Client or prospect security questionnaire | A copy of the information security policy, access control, vendor management and incident response | The whole document; sections 4, 12 and 14 most often |
| FTC Safeguards Rule (non-bank financial institutions such as mortgage brokers, tax preparers, auto dealers that finance) | A qualified individual, a written risk assessment, access controls, encryption, MFA, secure disposal, change management, monitoring and testing, training, service provider oversight, a written incident response plan and reporting to the board | Sections 2, 4, 5, 7, 10, 11, 12, 13, 14 and 18; the risk assessment itself is a separate document |
| HIPAA Security Rule (covered entities and business associates) | Administrative safeguards including a security management process with risk analysis, assigned security responsibility, workforce security, information access management, security awareness and training, security incident procedures, a contingency plan, evaluation and business associate contracts | Sections 2, 4, 9, 12, 13, 14, 15 and 18; counsel confirms the full set of required policies |
| State privacy and breach notification laws | Reasonable security measures and notification within set periods after a breach | Sections 7 and 14, with notification left to counsel because the periods differ by state |
The FTC publishes a plain-language summary of the Safeguards Rule elements, and the HIPAA administrative safeguards are at 45 CFR 164.308 (both sources linked at the end, checked on November 7, 2026). Neither this guide nor the template is legal advice; if a regulation applies to you, counsel reviews the finished policy.
How is the template organized?
The template follows the six functions of NIST CSF 2.0, published on February 26, 2024, which describe cybersecurity outcomes at their highest level: Govern, Identify, Protect, Detect, Respond and Recover. Each policy section also maps to the CIS Controls v8 control families whose Implementation Group 1 safeguards (56 of them, which CIS calls essential cyber hygiene) are the realistic target for a business of this size. The cross-reference is printed as appendix C in the download.
| CSF 2.0 function | What it means | Template sections |
|---|---|---|
| Govern | Strategy, expectations, roles and policy are established and monitored | 1 Purpose and scope, 2 Roles, 3 Acceptable use, 17 Exceptions, 18 Review, 19 Enforcement |
| Identify | Current risks and assets are understood | 7 Data classification, 11 Vulnerability management (inventory) |
| Protect | Safeguards are in place to manage risk | 4 Identity and access, 5 Devices, 6 Network, 7 Data handling, 8 Email and web, 9 Backup, 13 Training, 16 Physical |
| Detect | Possible attacks are found and analyzed | 10 Logging and monitoring |
| Respond | Actions are taken on a detected incident | 14 Incident response |
| Recover | Affected assets and operations are restored | 9 Backup and recovery, 15 Continuity and disaster recovery |
Section-by-section guidance with a minimum for 10 to 100 people
Each heading below matches a section of the template. The "why" explains what goes wrong without the section; the minimum is the bracketed value we suggest for a business of 10 to 100 people and no dedicated security staff. Raise a minimum when an insurer, client or regulation asks for more. Lower one only by recording an exception.
1. Purpose and scope
Why: the most common policy failure is a device or account nobody thought was covered, usually a personal phone with company email on it. Minimum: scope covers every person, every device that touches company data (company-owned or personal), every account and cloud service, and vendors through their contracts.
2. Roles: owner, administrators, staff, vendors
Why: a policy without a named owner is a document, not a program. Minimum: the policy owner is the IT director or a more senior executive accountable for IT; security administrators (your IT lead, your managed IT provider or both) operate the controls and keep the evidence; managers approve access and report leavers the same day; every employee follows the policy and reports incidents; vendors meet the requirements written into their contracts. The owner reports to leadership at least annually. A virtual CISO can hold the operating side of the owner role for a company that has no one with the time.
3. Acceptable use pointer
Why: the rules staff follow day to day belong in a document they can read in fifteen minutes and sign. Minimum: the cybersecurity policy references the acceptable use policy, requires acknowledgment at hire and annually, and says the stricter rule wins where the two differ. Use the acceptable use policy template as the companion.
4. Identity and access
Why: most incidents still begin with a credential. Minimum: MFA on every internet-reachable account, phishing-resistant MFA (passkeys or hardware keys) for administrators where supported, a company password manager for everyone, passwords of at least 14 characters changed on suspicion rather than on a calendar, least privilege, written joiner, mover and leaver steps with access disabled within 4 hours on the final day, separate administrator accounts for administrative work, global administrator roles held by two or three named people, and a quarterly access review that produces a dated sign-off.
5. Device and endpoint protection
Why: unmanaged and unpatched devices are where commodity malware lands. Minimum: managed EDR on every computer with someone watching the alerts (a managed detection and response service if nobody is awake at 2 a.m.), full-disk encryption with escrowed keys on every laptop, device management enforcing lock and settings, operating system and browser updates within 14 days and within 72 hours for critical or actively exploited vulnerabilities, other applications within 30 days, no local administrator rights for everyday accounts, unsupported systems retired within 90 days of end of support, and lost devices reported within an hour.
6. Network and remote access
Why: an administrative service exposed to the internet is an open invitation. Minimum: a managed business firewall per site with configuration backed up, a guest network separate from company systems, MFA on all remote access, nothing administrative (Remote Desktop, management consoles) published directly to the internet, default passwords changed on every device, and printers, cameras and smart devices on their own segment.
7. Data classification, handling and retention
Why: staff cannot protect data they cannot tell apart. Minimum: four classes (Restricted, Confidential, Internal, Public) with one line of handling rules each, a named owner for each business dataset, Restricted data kept only in company systems and never in personal cloud or AI accounts, a one-page retention schedule, and documented disposal for paper and devices. If you have not yet listed what data you hold and where, the IT risk assessment template walks through it.
8. Email and web security
Why: email is the delivery route for phishing and payment fraud. Minimum: a filtering service with link and attachment protection, external sender labels, SPF and DKIM with DMARC at enforcement, automatic external forwarding blocked, web filtering on managed devices, a verbal verification rule for any payment or bank detail change, and a no-blame reporting route.
9. Backup and recovery
Why: when prevention fails, a restorable backup is the difference between a bad week and a closed business. Minimum: the 3-2-1 rule (three copies, two media types, one off site), at least one immutable copy that an attacker with administrator credentials cannot delete, a separate backup of Microsoft 365 or Google Workspace, backup credentials separate from everyday administrator credentials, daily job monitoring, a monthly file restore test and a quarterly timed full restore test with the result written down. Recovery objectives come from the business, which is what the business continuity plan template is for.
10. Logging and monitoring
Why: you cannot respond to what you never saw. Minimum: audit logging turned on in the identity platform, email, file services, firewall and EDR, retained 90 days online and a year in archive, high-risk alerts (new forwarding rules, privilege changes, mass deletion, EDR detections, disabled security tools) reviewed by someone around the clock, and logs protected from the people whose actions they record.
11. Vulnerability management
Why: attackers scan for known weaknesses continuously; you should know about them first. Minimum: a hardware, software and cloud inventory reviewed quarterly, monthly authenticated scans, fix windows by severity (critical or exploited within 72 hours, high within 14 days, medium within 30 days), an annual external penetration test with findings tracked to closure, and a documented secure baseline.
12. Vendor and third-party security
Why: a vendor with your data or a login is part of your attack surface. Minimum: a register of every third party with access or data, a proportionate questionnaire before Restricted or Confidential data is shared, contract terms for confidentiality, incident notification within 72 hours, subprocessors and data return, any regulation-specific agreement (a HIPAA business associate agreement, for example) signed first, named vendor accounts with MFA, and a review twice a year.
13. Security awareness training
Why: people are the control that catches what filters miss, if they have been taught what to look for. Minimum: training within two weeks of hire and annually, covering phishing including AI-written messages and voice or video impersonation, MFA and password practice, data handling, safe AI use and how to report; quarterly phishing simulations used for coaching; role-specific training for administrators and finance staff; and a completion record. Our security awareness training guide covers the program design.
14. Incident response
Why: the first hour of an incident is decided by whether anyone knows who to call. Minimum: a definition of an incident that includes lost devices and misdirected data, named roles (incident lead, technical lead, communications, legal, record keeper), an always-open reporting route with no penalty, a rule that evidence is preserved before anything is rebuilt, notification decisions made with counsel as required by applicable law or contract (many laws and contracts set deadlines measured in hours or days), an incident log retained for at least three years, and a lessons-learned review within two weeks. The incident response plan guide provides the operating document the policy points to.
15 and 16. Continuity, disaster recovery and physical security
Why: a ransomware event or a flood ends the same way if nobody has rehearsed recovery, and a propped-open server room door undoes every technical control. Minimum: a business continuity plan and an IT disaster recovery plan exercised annually, servers and network gear in a locked room or cabinet, screens locked and positioned away from visitors, and access cards handled in the leaver process.
17. Exceptions
Why: every business has a system that cannot meet a rule; the question is whether that fact is written down with an owner. Minimum: written exceptions approved by the policy owner with the business reason, compensating controls, the person accepting the risk and an expiry of no more than 12 months, kept in a register that is reviewed with the policy.
18. Review cadence
Why: a policy that describes last year's company is evidence of neglect, not of care. Minimum: review at least annually, after any significant incident and after major changes (a new line-of-business system, an office move, a merger, a new IT provider, a new regulatory or contractual obligation), with every review recorded even when nothing changed.
19. Enforcement and 20. Approval record
Why: a policy that is never enforced teaches staff that none of the policies matter, and an unsigned policy is a draft. Minimum: compliance is a condition of employment and of vendor contracts, violations go through the disciplinary procedure in proportion to harm and intent, good-faith reports of mistakes are treated as incidents to learn from, and the approval table records every version with the approver's name, title and date.
How do you roll out a cybersecurity policy?
- Name the owner first. The IT director or a more senior executive accountable for IT signs up to own the policy before anyone edits the template. Without that, the document stalls at draft.
- Compare the template with what you actually do. Work through the twenty sections with your IT lead or managed IT provider and mark each minimum as met, not met, or not applicable. The SMB cybersecurity checklist is a fast way to do this, and our free online cybersecurity assessment gives an outside view.
- Decide the gaps. For each unmet minimum, either plan the control with a date or write an exception with compensating controls. Do not quietly lower the bracketed value to match the current state; that is how policies become fiction.
- Send it for review. Leadership reads it for business fit, HR reads the enforcement and training sections, and counsel reads it where a regulation or contract applies.
- Approve and record. Fill in the approval table with name, title and date. Store the signed version where staff can find it and where it survives an outage.
- Brief the company. A thirty-minute session that explains what changed for staff (usually MFA, the password manager, reporting and data handling) and points them to the acceptable use policy they will sign.
- Collect acknowledgments. Staff acknowledge the acceptable use policy; managers and administrators acknowledge the cybersecurity policy. Keep the record with the version number.
- Start the evidence habit. Each section's guidance note lists the evidence to keep (MFA coverage report, patch compliance report, restore test log, access review sign-offs). Put a recurring calendar entry against each one.
How do you keep the policy alive?
Three triggers keep a policy honest, and the template's review record has a row for each.
- Annually. The owner rereads every section against what the company does now, updates minimums that an insurer or client has raised, closes or renews each exception, and reports to leadership on incidents, open exceptions and training completion. Record the review even if nothing changed.
- After an incident. The lessons-learned review asks which section would have prevented or shortened the incident and whether the rule was missing, unclear or ignored. Each answer leads to a different fix: a new clause, a rewrite, or enforcement and training.
- After a major change. A new line-of-business system changes the data classification and vendor sections; a new IT provider changes roles; a new client contract or regulation may add requirements; adopting AI tools changes the acceptable use pointer and the data handling rules.
A policy is not compliance
Adopting this template does not make a business compliant with the FTC Safeguards Rule, HIPAA, a state privacy law, an insurance policy or a client contract. Compliance comes from the controls operating, the evidence that they operate, and, where a regulation applies, review by qualified counsel of both the policy and the program around it. A filled-in template is a statement of intent and a record of expectations. It is useful precisely because it is checkable; use the evidence notes under each section to make sure it checks out.
How NetSys helps with the policy and the controls behind it
Our small business cybersecurity service runs the controls in sections 4 to 11 for firms of 5 to 75 people, with ThreatDown endpoint protection, managed patching, backup monitoring and 24/7 alert response, and produces the evidence each section asks for. Where a company needs someone to own the program without hiring a security executive, the virtual CISO service holds the policy owner's operating duties: the annual review, exception decisions, vendor reviews and the leadership report. Either way, the policy stays yours, approved by your leadership and reviewed by your counsel.
Frequently asked questions
What should a small business cybersecurity policy include?
Purpose and scope, roles, a pointer to the acceptable use policy, identity and access, device protection, network and remote access, data classification and retention, email and web security, backup and recovery, logging, vulnerability management, vendor security, training, incident response, exceptions, review cadence, enforcement and an approval record. The template has one section for each, with a guidance note and a suggested minimum.
Who should own the cybersecurity policy in a small company?
The IT director or a more senior executive accountable for IT. The owner does not need to configure anything; they approve the policy, decide exceptions, make sure the review happens and report to leadership. The person operating the controls, often a managed IT provider, should not be the only check on themselves, which is why the owner and the administrator roles are separate in the template even when one firm fills both.
How long should the policy be?
Long enough to state every requirement and no longer. The template runs to roughly a dozen pages with the guidance notes, and a few pages shorter once they are deleted. Detailed procedures, runbooks and configuration settings belong in separate documents the policy references, so the policy itself can be read by a manager in under an hour.
Is a sample cybersecurity policy enough for cyber insurance or a client questionnaire?
A signed, dated policy that matches what the company does will satisfy most questionnaire requests for a copy of the information security policy. What insurers and clients check next is whether the answers are true: MFA coverage, EDR on every endpoint, backup tests, training records. The policy helps you answer accurately; it does not substitute for the controls, and inaccurate insurance answers can jeopardize a claim.
How does the template relate to NIST CSF 2.0 and CIS Controls?
The sections are grouped by the six CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover), and appendix C maps each section to the CIS Controls v8 families whose Implementation Group 1 safeguards fit a small business. The mapping is a reading aid that helps you talk to auditors and insurers in their vocabulary. It is not an assessment, a certification or a statement that you meet either framework.
Do we need separate policies for HIPAA or the FTC Safeguards Rule?
Often yes, in part. Both regimes expect specific documented elements (a written risk assessment and a designated qualified individual under the Safeguards Rule; the administrative, physical and technical safeguard standards under HIPAA). This template covers the general security policy that those documents sit alongside and references them where they belong. Counsel or a compliance specialist confirms the full set for your situation.
How often should the policy be reviewed?
At least once a year, after any significant security incident, and after major changes such as a new core system, an office move, a change of IT provider, a merger or a new regulatory or contractual obligation. Record every review in the approval record even when nothing changed; the record of review is part of the evidence.
Get the controls behind the policy running
Bring your draft policy, your current IT setup and any insurer or client questionnaire to a short scoping call. We will tell you which minimums you already meet, which need work, and what it takes to produce the evidence for each section.
Sources and further reading
- NIST, The NIST Cybersecurity Framework (CSF) 2.0 (CSWP 29, February 26, 2024): the six Core Functions (Govern, Identify, Protect, Detect, Respond, Recover) and their descriptions. Checked on November 7, 2026.
- Center for Internet Security, CIS Critical Security Controls Implementation Group 1: IG1 as essential cyber hygiene, 56 safeguards, aimed at small and medium enterprises. Checked on November 7, 2026.
- Federal Trade Commission, FTC Safeguards Rule: What Your Business Needs to Know: the elements of the required information security program. Checked on November 7, 2026.
- 45 CFR 164.308, Administrative safeguards (HIPAA Security Rule), via GovInfo: the administrative safeguard standards and implementation specifications. Checked on November 7, 2026.
Discuss small business cybersecurity for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.