Cyber Security Policy Template

What is a cyber security policy?

A cyber security policy is a written document that sets out how your organisation keeps its information and systems secure, who is responsible, and what everyone is expected to do. It's the high-level statement that ties together the more specific rules, like how passwords work, who can access what, how data is handled, and what happens when something goes wrong.

For most small and medium businesses it's the document a customer's security team asks for before sharing data or signing a contract. A clear, genuine policy that reflects how you actually work beats a long generic one.

Cyber security vs information security vs IT security policy

These terms overlap so much that, for a policy document, you can treat them as the same thing:

• Information security policy (infosec), the broadest term; protecting information in any form, including paper. It's the language ISO 27001 uses.
• Cyber security policy, focuses on protection from digital/online threats. The most common search term and the one customers tend to use.
• IT security policy, frames it around your IT systems and technology specifically.
• ISMS policy, the top-level policy within an Information Security Management System under ISO 27001, again, the same core document.

Pick the title your customers use most. The content matters far more than the label.

Frameworks a cyber security policy can reference

You don't need certification to align your policy with a recognised framework, and naming one tells a reviewer you understand the standard they care about:

• ISO/IEC 27001 & 27002, the international standard for information security management and its catalogue of controls.
• NIST Cybersecurity Framework (CSF), a widely used model organised around Identify, Protect, Detect, Respond and Recover.
• CIS Controls, a prioritised, practical set of safeguards that's friendly to smaller teams.
• SOC 2, common in software/SaaS, focused on trust service criteria including security.
• National baselines, the UK's Cyber Essentials and Australia's Essential Eight (ACSC) are pragmatic starting points.

What to include: cyber security policy template structure

Adapt this outline. Keep the main policy readable, then let the supporting policies hold the detail:

1. Purpose and scope, why the policy exists and who/what it covers (staff, contractors, systems, data).
2. Roles and responsibilities, who owns security and what every worker must do.
3. Acceptable use, how company systems, devices and internet/email may be used.
4. Access control, the principle of least privilege and how access is granted and removed.
5. Passwords and authentication, password rules and multi-factor authentication.
6. Data protection and classification, how information is classified, stored, shared and disposed of.
7. Devices and endpoints, laptops, mobiles, BYOD, updates and anti-malware.
8. Network and remote working, secure connections, Wi-Fi and working away from the office.
9. Incident response, how security incidents are reported and handled.
10. Backups and continuity, how data is backed up and restored.
11. Third parties and vendors, security expectations for suppliers with access to your data.
12. Awareness and training, how staff are trained to spot phishing and other threats.
13. Compliance, monitoring and review, the framework you follow, how you monitor, and how often you review the policy.

Supporting policies

The overarching policy works best when a handful of specific policies sit beneath it. The most commonly requested ones, each with their own free template:

• Password policy, password and multi-factor authentication rules.
• Access control policy, who can access what, and least privilege.
• Data security & classification policy, how information is classified and protected.
• Incident response policy, how you detect, report and handle incidents.
• Network security policy, securing networks, Wi-Fi and remote access.
• AI acceptable use policy, the newer rules for using AI tools safely.

How to implement your cyber security policy

A policy only reduces risk if people follow it and it reflects what you actually do.

1. 1

   Pick a framework to anchor to

   Choose the framework your customers care about (ISO 27001, NIST CSF, Essential Eight) and align your language to it.

2. 2

   Adapt the policy to your business

   Reflect your real systems, tools and ways of working rather than describing an idealised setup.

3. 3

   Add the supporting policies

   Put the password, access, data, incident and network policies in place beneath it.

4. 4

   Approve and communicate

   Have it approved by management, then share it and cover it in induction.

5. 5

   Train your team

   Run basic awareness training, phishing is still the most common way in.

6. 6

   Review regularly

   Review at least annually and after any incident or major system change.

Free template vs done-for-you document

Comfortable adapting it and writing the supporting policies yourself? The free template is all you need. Facing a customer security review with a deadline? The done-for-you version arrives written and aligned to your framework.

Frequently asked questions

Supporting policies & related guides