A cybersecurity policy is a foundational document that gives your small business a clear way to explain how employees should protect company systems, accounts, devices, and digital data.
It turns security from scattered advice into shared expectations by answering questions such as which practices are allowed, what employees should avoid, who owns which decisions, and what happens when something goes wrong.
This guide gives you a practical framework for writing or reviewing a cybersecurity policy for your small business. You can use it as a starting template, adapt each section to your tools and risks, and connect the policy to operational controls that make it easier to follow.
What is a cybersecurity policy?
Why small businesses need a cybersecurity policy
Cybersecurity policy template: 9 core sections
Why do IT security policies for businesses fail?
How Proton Pass for Business supports policy enforcement
What is a cybersecurity policy?
A cybersecurity policy is a written document that defines how your business protects information, systems, devices, and accounts from cyber threats(nyt vindue). It should explain what employees and contractors, including managers and administrators, are expected to do in day-to-day work.
A strong policy should feel like a reference people can actually use when decisions are unclear. It should answer questions like:
- Which passwords and accounts need extra protection?
- Can employees use personal devices for work?
- Where should sensitive data be stored?
- Who can approve access to business systems?
- What should someone do if they suspect a breach?
- How often will the policy be reviewed?
- What happens to access when someone leaves the company?
For SMBs, the best cybersecurity policy is short, clear, and specific enough to remove guesswork.
Why small businesses need a cybersecurity policy
A cybersecurity policy can help your business in three ways:
Sets expectations: Employees know what is allowed, what is required, and what needs approval.
Creates accountability: If access, devices, data handling, and incident response have clear owners, security stops depending on individual memory.
Supports compliance and customer trust: Being compliant with data regulations such as the GDPR requires your business to process personal data securely using appropriate technical and organizational measures, including risk analysis, organizational policies, and technical measures.
A written information security policy helps show that your business has considered those responsibilities and created controls to reduce risk.
Proton’s SMB cybersecurity report reinforces why this matters for smaller teams: SMBs often face real security risk without the same resources as larger enterprises. A practical policy gives those teams a way to prioritize the basics and make them repeatable.
Cybersecurity policy template: 9 core sections
Use the following structure as a cybersecurity policy template. You don’t need to make every section overly long. The goal is to define the rule, assign ownership, and explain how employees should apply it.
1. Policy purpose and scope
Start by explaining why the policy exists and who it applies to. This section prevents a common problem: people assuming the policy only applies to “IT systems” or full-time employees.
Template copy:
This cybersecurity policy defines how [Company Name] protects business systems, accounts, devices, and data. It applies to employees, contractors, temporary workers, and third parties who access company information or systems.
The scope should include company-owned devices, approved cloud services, business accounts, remote work environments, personal devices used for work, and vendor access.
2. Acceptable use policy
The acceptable use section explains how employees can use company systems and accounts.
It should cover:
- Approved business software and services
- Restrictions on unauthorized apps or browser extensions
- Rules for downloading files and software
- Use of company email and messaging
- Personal use of company devices
- Prohibited activity, such as sharing accounts without approval or bypassing security controls
Keep this section practical. Employees should understand which everyday choices are acceptable without needing to interpret technical language.
Template copy:
Employees must use approved business systems for company work. Unapproved applications, personal storage accounts, and unauthorized browser extensions must not be used to store, process, or share company data unless approved by [role/team].
3. Password and access management requirements
It’s important to take admin controls into consideration. A policy can define who should have access, when two-factor authentication (2FA) is required, and how offboarding should work, but teams still need an operational way to apply those rules. A business password manager like Proton Pass for Business supports that through its admin panel, where your team can manage access, apply policies, review activity, and reduce reliance on informal password handling.
Your policy should state that:
- Work passwords must be unique and strong.
- Passwords must not be reused across business and personal accounts.
- Shared credentials must not be sent through unapproved ways such as email, chat, screenshots, tickets, or documents.
- 2FA should be enabled everywhere, starting with high-risk accounts.
- Access should be granted based on role and business need.
- Access must be removed when someone changes roles or leaves.
- Exceptions must be documented, including cases where 2FA cannot yet be enabled, a shared account is temporarily unavoidable, a vendor needs time-limited elevated access, or a legacy system cannot meet the standard password or access requirements.
Proton’s guide to creating a password policy can support this section with more detail on password rules, sharing, access management, and two-factor authentication.
This is also where policy needs operational support. A rule that says “use unique passwords” is weak if employees still have to create and remember every password manually.
A business password manager like Proton Pass for Business helps teams turn password requirements into daily practice: Employees can generate strong, unique passwords, store them in encrypted vaults, use autofill, and share passwords securely instead of using unsafe channels — all in one app.
Template copy:
Work passwords must be unique, strong, and stored in the approved business password manager. Passwords must not be reused across personal and business accounts or shared through email, chat, screenshots, tickets, or documents. Multi-factor authentication must be enabled for high-risk accounts, and access must be granted based on role and business need. When an employee, contractor, or vendor no longer needs access, permissions must be reviewed and removed.
4. Data classification and handling
A cybersecurity policy should define the types of information your business deals with and how each type of information should be protected. Here are three tiers that a small business can use without complicating things:
Public: Information approved for public use
Internal: Business information for employees and approved contractors that wouldn’t be appropriate to share externally
Confidential: Client data, financial data, credentials, contracts, employee records, or sensitive operational information — anything that can cause harm if leaked
Template copy:
Confidential information must only be stored in approved systems, shared with authorized people, and protected from unauthorized access. Employees must not store confidential business data in personal accounts, unmanaged documents, or unapproved devices.
5. Incident reporting and first response
Your policy should explain what employees must do when they identify or suspect a vulnerability. This does not need to be a full incident response plan, but it should define first actions and ownership.
Include examples such as:
- Suspicious login alerts
- Lost or stolen devices
- Phishing emails
- Accidental data sharing
- Malware warnings
- Unusual account activity
- Unauthorized access to documents or systems
Use Proton’s guide to data breach prevention for businesses for further guidance on reducing breach risk before an incident happens.
Template copy:
Employees must report suspected security incidents immediately to [role/team/contact]. Employees must not delete evidence, reset affected systems, or communicate externally about an incident unless instructed by the incident owner.
6. Remote work and Bring Your Own Device (BYOD) rules
Remote work and personal devices within your business network can create unnecessary risk if not managed properly. Your cybersecurity policy should explain whether employees can use personal devices, which security requirements apply (such as BYOD security), and what happens if a device is lost or someone leaves.
Include:
- Approved devices and operating systems
- Screen locks and device encryption
- Reporting lost or stolen devices
- Use of public WiFi(nyt vindue)
- Access to company systems from personal devices
- Rules for personal cloud storage
- Requirements for authentication apps and 2FA
- Offboarding steps for remote employees
Proton’s remote work policy and BYOD policy guides can support this section with more detailed rules for distributed teams and employee-owned devices.
Template copy:
Employees may only access company systems from approved devices that meet security requirements. Lost or stolen devices must be reported immediately. Company data must not be stored in personal cloud accounts or unmanaged applications.
7. Third-party vendor access
Small businesses often rely on agencies, contractors, software providers, accountants, consultants, and managed service providers. Vendor access should never be treated casually because it can create a backdoor your business doesn’t fully control.
A business password manager can help make that control more practical by helping teams keep vendor credentials scoped, monitored, and easy to revoke when an engagement ends.
Your policy should define:
- Who can approve vendor access
- Which systems vendors can access
- Whether vendor accounts must be individual or shared
- How long access lasts
- How often vendor access is audited
- How minimum permissions are determined for each vendor
- What happens when a contract ends
This section also supports supply chain security. The NCSC’s 10 Steps(nyt vindue) includes it as a key area for managing cyber risk, which is especially relevant for small businesses that outsource parts of IT, finance, marketing, or operations.
Template copy:
Third-party access must be approved by [role/team], limited to the systems required for the work, and reviewed at the end of the engagement. Vendor access must be removed when it is no longer needed.
8. Employee training requirements
A cybersecurity policy won’t work if people only see it during onboarding. Regular security awareness training ensures that your policy is always followed.
Your policy should explain:
- When employees receive security training
- Which topics training covers
- How often refreshers happen
- Who must complete training
- How new risks or policy changes are communicated
Training topics can include phishing, password management, 2FA, safe file sharing, data handling, remote work, device security, and incident reporting.
Keep training short and practical. A succinct five-page policy with a checklist supported by short examples is usually more useful than an overstuffed, verbose 40-page document.
Template copy:
Employees must complete cybersecurity training during onboarding and at least [annually/twice a year]. Training will cover password security, phishing, data handling, device security, and incident reporting.
9. Policy review cadence
A cybersecurity policy should change as the business changes. New systems, remote work patterns, vendors, regulations, and incidents can all make old rules incomplete.
Define:
- How often the policy is reviewed
- An owner for the cybersecurity policy review
- How changes are approved
- How updates are communicated
- What triggers an out-of-cycle review
Template copy:
This policy will be reviewed every [six or 12 months] by [owner]. It must also be reviewed after a major security incident, significant system change, regulatory update, or material change in business operations
Why do IT security policies for businesses fail?
Most cybersecurity policies fail for practical reasons:
The policy is too long: A small business cybersecurity policy should not try to cover every possible scenario. If it becomes too long, employees stop using it. Keep it concise and link to deeper procedures where needed.
The language is too technical: Employees should not need a security background to follow business cybersecurity guidelines. Use plain language and replace technical terms with everyday explanations where possible.
The policy is presented only during onboarding: If the policy is only mentioned once during onboarding, it will not shape daily behavior. Reinforce it through training, reminders, quick-reference guides, and updates when processes change.
The policy is never reviewed: A policy written two years ago may not reflect current systems, remote work practices, vendor access, or regulatory expectations. Review it regularly.
The policy is not enforced: This is the most common reason for failure. A policy can say that passwords must be stored securely, 2FA must be enabled, or vendor access must be removed, but those rules don’t matter if nobody keeps on top of it. Enforcement means assigning owners, using admin controls where available, reviewing exceptions, and making secure behavior easier than the shortcut.
For password and access management, Proton Pass for Business can help support policy enforcement operationally. It gives teams encrypted vaults, secure sharing, password generation, and admin visibility, so your business is not relying only on theory. Admins can also monitor password health, credential reuse, and dark web breach exposure across the organization securely, without knowing the employees’ passwords.
How Proton Pass for Business supports policy enforcement
A cybersecurity policy is only useful if the business can put it into practice. Password and access rules are a good example. You can write that passwords must be unique, shared securely, and removed when people leave. But if employees still use browsers, spreadsheets, chat messages, or personal notes, the policy is easy to ignore.
Proton Pass for Business gives employees a secure way to generate, store, autofill, and share credentials, while giving admins better visibility into how access is managed. This makes the password and access management section of your policy easier to follow.
For small businesses, the benefit is practical. You don’t need a large security team to start improving credential hygiene. A business password manager gives your team a central place for work credentials, supports safer collaboration, and helps reduce the risk of password reuse or ungoverned sharing.
Access control is one of the most practical places to turn policy into action. When credentials are easier to generate, store, share, and revoke securely, employees are less likely to rely on unsafe workarounds. Managers also gain a clearer way to support password and access requirements in daily operations.
Enforce your cybersecurity policy with a secure business password manager like Proton Pass for Business.
