Policy starters

Policies, plans and starter documents.

Every SME should have a small set of clear, signed policies. These are working starters — written in plain English, organised consistently, ready to edit.

Master policy

Information Security Policy

The master policy. Sets out how the business protects information — and connects to every other policy below.

Policy

Acceptable Use Policy

What staff can and can't do with the company's computers, accounts, and internet connection.

Policy

Password Policy

How [Company Name] handles passwords and account login. Follows current NCSC guidance.

Policy

AI Acceptable Use Policy

What staff can and can't put into AI tools. One A4. Plain English.

Policy

BYOD & Mobile Device Policy

What it takes for a phone, tablet, or laptop to be allowed to handle company data.

Policy

Remote & Hybrid Working Policy

Working from home, the train, the cafe — safely.

Policy

Data Retention & Disposal Policy

What we keep, for how long, and how we get rid of it.

Policy

Supplier Security Requirements

What [Company Name] expects of any supplier that handles its data or systems.

Procedure

Joiner & Leaver Procedure

Same checklist, every time.

Plan

Incident Response Plan

What to do when something goes wrong. Print and pin it to the wall.

Report template

Quarterly Board Cyber Report

A one-page board template.

Public-facing notice

Privacy Notice (for your website)

A starter template for the customer-facing privacy notice on your website.

Worksheet

Tools / Software Asset Register

A simple register of every tool the business uses.

Worksheet

Data Map / Record of Processing Activities (ROPA)

Four boxes. Five minutes.

Reference

Cyber Incident Contact Card

Wallet-sized. For when your phone has your work email and your phone is the problem.