Policy starters

Policies, plans and starter documents.

Every SME should have a small set of clear, signed policies. These are working starters — written in plain English, organised consistently, and ready to edit. Replace the bracketed placeholders, drop in your specifics, get a director to sign and date them, and re-review annually.

Master policy

Information Security Policy

The master policy. Sets out how the business protects information — and connects to every other policy below.

Policy

Acceptable Use Policy

What staff can and can't do with the company's computers, accounts, and internet connection.

Policy

Password Policy

How [Company Name] handles passwords and account login. Follows current NCSC guidance.

Policy

AI Acceptable Use Policy

What staff can and can't put into AI tools. One A4. Plain English.

Policy

BYOD & Mobile Device Policy

What it takes for a phone, tablet, or laptop to be allowed to handle company data.

Policy

Remote & Hybrid Working Policy

Working from home, the train, the cafe — safely.

Policy

Data Retention & Disposal Policy

What we keep, for how long, and how we get rid of it.

Policy

Supplier Security Requirements

What [Company Name] expects of any supplier that handles its data or systems.

Procedure

Joiner & Leaver Procedure

Same checklist, every time. Stops “why does Sam still have access” three years later.

Plan

Incident Response Plan

What to do when something goes wrong. Print and pin it to the wall.

Report template

Quarterly Board Cyber Report

A one-page board template. Three sections, same shape every quarter.

Public-facing notice

Privacy Notice (for your website)

A starter template for the customer-facing privacy notice on your website.

Worksheet

Tools / Software Asset Register

A simple register of every tool the business uses. The spreadsheet that prevents shadow IT problems.

Worksheet

Data Map / Record of Processing Activities (ROPA)

Four boxes. Five minutes. Most SMEs find at least one surprise.

Reference

Cyber Incident Contact Card

Wallet-sized. For when your phone has your work email and your phone is the problem.