Write Your Cybersecurity Policy This Afternoon
"Write a security policy" sounds like something that takes three months, costs $15,000 in legal fees, and produces a 40-page document nobody reads. Here is the version that takes four hours and actually protects your business.
Why you need this now: The FTC Safeguards Rule requires a written information security plan for any business "significantly engaged" in financial activities — which includes accounting firms, auto dealers, mortgage brokers, and fintech companies. GDPR requires documentation of security measures. Even if no regulation requires it, your cyber insurance application will ask for it. Not having a written policy can be used against you in court if you are sued after a breach.
The Five Sections You Actually Need
Most small business security policies are bloated with sections nobody reads — detailed encryption standards, 12-page access control matrices, hardware lifecycle management procedures. You do not need any of that. You need five things:
Who gets access to what. Minimum password requirements. Whether MFA is required (yes). What happens to accounts when someone leaves. This is half a page.
Which devices can access company data. Whether personal devices are allowed (BYOD). Encryption requirements. Software update policy. What to do if a device is lost or stolen.
What counts as sensitive data. Where it can be stored. Whether it can be emailed. How to share files with clients. Data retention — how long you keep things before deleting them.
What to do when something goes wrong. Who to call first. How to contain an incident. When to notify customers. When to notify your insurance company. This is the section people reach for in a crisis — make it clear.
How often employees get security training. What happens if someone violates the policy. How the policy gets updated. Who is responsible for maintaining it.
Section 1: Password & Access Policy
Here is a perfectly serviceable access policy for a 15-person company. Copy it, adjust the brackets, and move on:
1. Password Requirements
- All company accounts must use unique passwords — never reuse passwords across services.
- Passwords must be at least 12 characters. Use a passphrase (e.g., "correct-horse-battery-staple") rather than a short complex string.
- A password manager (Bitwarden) is provided by the company. Store all work passwords in it. Do not store passwords in browsers, spreadsheets, or notes apps.
- Multi-factor authentication (MFA) is required on: email, financial systems, cloud storage, and any system containing customer data. Use an authenticator app or hardware key. SMS is acceptable only when no other option exists.
2. Access Control
- Access to company systems is granted based on job requirements. If you do not need access to do your job, you should not have access.
- Shared accounts are prohibited. Each person gets their own login everywhere.
- When an employee leaves, their access to all company systems will be revoked within [24 hours / end of last business day].
- Review access rights quarterly. Remove accounts that are no longer needed.
Section 2: Device Security
2. Device Security
- All company-issued devices must have full-disk encryption enabled (BitLocker for Windows, FileVault for Mac).
- Operating system updates must be installed within 7 days of release. Security patches must be installed within 48 hours.
- Personal devices used for work (BYOD) must have: a 6-digit passcode, encryption enabled, automatic OS updates, and Find My Device / remote wipe configured.
- Lost or stolen devices must be reported to [contact] immediately. The device will be remotely wiped.
- Do not leave company devices unlocked and unattended in public places. Use a privacy screen filter when working with sensitive data in public.
Section 3: Data Handling
3. Data Handling
- "Sensitive data" includes: customer names and contact information, payment records, employee records, contracts, and any information subject to confidentiality agreements.
- Sensitive data must be stored in company-approved cloud services (Google Drive / OneDrive / Dropbox Business). Do not store sensitive data locally on your hard drive.
- Never email sensitive data as unencrypted attachments. Use secure sharing links with access controls, or encrypted email if your provider supports it.
- Do not upload company data to personal accounts (personal Google Drive, personal Dropbox, etc.).
- Delete data when it is no longer needed. Retention periods: customer records — [X years after last transaction]; employee records — [X years after departure]; financial records — [per accountant's guidance].
Section 4: Incident Response — The Page You Hope Nobody Reads
During a security incident, nobody reads a 10-page procedure. They need to know three things: who to call, what to do first, and what to do next. Keep this section to one page.
4. Incident Response
If you suspect a security incident (phishing, malware, ransomware, data breach, lost device, unauthorized access):
1. Do NOT delete anything or turn off the affected device. Disconnect it from the network.
2. Immediately contact: [Name, phone, email — the designated security contact].
3. If the security contact is unavailable, contact: [Backup name, phone, email].
4. Do NOT discuss the incident externally until instructed to do so.
5. Document what you observed: time, date, what looked wrong, what actions you took.
For ransomware specifically: Disconnect the device from the network. Do not shut it down. Contact [security contact + cyber insurance provider].
For data breach / customer data exposure: Contact [security contact + legal counsel]. We may have legal notification obligations with strict deadlines.
Section 5: Training & Enforcement
5. Training & Enforcement
- All employees must review this policy upon hiring and annually thereafter.
- Security awareness training (phishing, passwords, safe browsing) will be conducted [annually/quarterly].
- Violations of this policy should be reported to [manager/security contact].
- This policy will be reviewed and updated annually by [person/role], or sooner if there is a significant security incident or change in business operations.
Policy last updated: [Date]
Policy owner: [Name / Title]
What to Do After You Finish
- Have everyone sign it. Not for legal reasons — though it helps — but because signing something makes people pay attention. A checkbox on a PDF nobody opens is not a signature.
- Store it where everyone can find it. A shared drive folder called "Security" with this document and nothing else. When someone asks "what's our password policy," the answer should be "it's in the Security folder."
- Review it annually. Put a calendar reminder. If you have not updated the policy in 18 months, it is probably out of date. Technology changes. Regulations change. Your business changes.
That is it. Four hours of work, one document, and your business now has something that most small businesses do not: a written, signed, enforceable security policy. This document alone will satisfy the "written information security plan" requirement of the FTC Safeguards Rule, help you qualify for cyber insurance, and — most importantly — actually reduce the likelihood that someone on your team does something that gets you breached.