Cyber security policies for small teams: what they cover, with a one-page outline

A cyber security policy for a small business is a short written set of rules that says how the team uses accounts, devices and data, and what to do when something goes wrong. business.gov.au’s cyber security checklist describes a policy that clarifies staff responsibilities for “data”, “computers and other devices”, “emails”, “websites” and “social media”. This guide explains the simple policies small teams commonly write and what each one covers, then gives a one-page cyber security policy outline to adapt. It isn’t legal advice, and no official source we used provides a policy template.

Why written policies help

business.gov.au describes policies as “high-level guidelines for your business”. Its guidance says policies help a business clarify who is responsible, make consistent decisions, meet legal and regulatory requirements, and keep running during a disruption.

For security, a written rule removes guesswork. If the policy says bank detail changes are always confirmed by phone, staff don’t have to decide under pressure whether an urgent email is genuine. ASD’s small business guide describes exactly this kind of “business specific” policy, such as “processes for reporting suspicious emails or for validating invoices are genuine before paying”.

business.gov.au also separates three terms:

• Policy: the high-level rule (for example, “we use MFA on business accounts”).
• Process: the series of actions that achieves it.
• Procedure: detailed instructions for one task.

A small team can usually keep the policy to one or two pages and put step-by-step instructions in separate procedures.

The policies small teams commonly write

These six areas cover most of what ASD’s small business guide and business.gov.au describe. A small business may combine them into one document.

1. Acceptable use

business.gov.au lists “appropriate use of computers, internet and social media” as a policy topic. An acceptable use policy commonly covers:

• what business devices and accounts are for
• personal use of business devices and internet, if allowed
• posting about the business on social media
• not installing unapproved software or browser extensions (see malicious browser extensions).

2. Passwords and MFA

ASD’s small business guide describes:

• a password manager to “create and store unique passwords for each of your important accounts”, or a passphrase of “a random mix of four or more words” kept unique
• not reusing a passphrase “across multiple accounts”
• turning on MFA “wherever possible, starting with your most important accounts”
• securing administrative accounts “with a strong passphrase or multi-factor authentication”
• limiting shared accounts and securing any that are used.

ASD’s MFA guide adds keeping recovery methods and backup codes in case an authenticator app is lost.

3. Devices

ASD’s small business guide describes:

• locking devices “with a passphrase, PIN or biometrics”
• automatic locking “after a short time of inactivity”
• automatic updates for devices and software
• keeping devices where unauthorised people can’t access them
• removing “all information from your business devices before selling, trading or throwing them away”.

A device policy often also says how staff report a lost or stolen device and who to tell.

4. Backups

ASD’s guide describes backups as “a regular or automatic practice in your business” and warns that without them “it could be impossible for you to recover your information after a cyber attack”. ASD’s backups page describes backing up “often” or turning on automatic backups. A backup policy usually records what is backed up, how often, where copies are kept and who checks that restoring works. The 3-2-1 backup guide explains a common approach to keeping copies.

5. Incident reporting

ASD’s emergency plan asks: “What is the process for your staff to report potential cyber security incidents?” business.gov.au describes making sure staff know how to report scams or suspected threats. This policy can be very short: who to tell, how, and that early reporting is welcome. The details sit in the one-page cyber incident response plan.

6. Remote and mobile work

business.gov.au lists “working from home or remotely” as a policy topic. A remote work section commonly covers which devices may be used, locking screens, home and public Wi-Fi, and keeping business data in approved business accounts. The working from home security guide explains the related settings.

Other topics worth knowing about

business.gov.au also lists “protecting customer information” as a policy topic. The OAIC explains that organisations covered by the Privacy Act 1988 must notify affected individuals and the OAIC when a data breach is likely to result in serious harm. Whether a business is covered depends on its circumstances; the OAIC is the place to check.

A one-page example policy outline

Template to adapt, not legal advice. This outline brings together the practices described in ASD’s small business guide and business.gov.au. The wording in square brackets is for the business to fill in or change. It doesn’t cover every situation and doesn’t address employment terms or staff monitoring.

[Business name] cyber security policy Version [x], approved by [name], [date]. Next review: [date].

Who this applies to: everyone who uses [business name] accounts, devices or data, including [contractors].

1. Using our systems. Business devices and accounts are for [business use / business and limited personal use]. Only approved software is installed. [Rules for social media posts about the business.]

2. Passwords and MFA. Each person has their own account. Passwords are unique and stored in [password manager], or are passphrases of four or more random words. MFA is turned on for [email, accounting, banking, file sharing and admin accounts]. Passwords and MFA codes are never shared with anyone who asks for them.

3. Devices. Devices lock automatically after [x] minutes and use a PIN, passphrase or biometrics. Automatic updates stay on. Lost or stolen devices are reported to [name] straight away. Devices are wiped before disposal.

4. Backups. [What] is backed up [how often] to [where]. [Name] checks that a restore works every [period].

5. Payments. Changes to bank details are confirmed by phone using a number sourced independently (for example, one already on file), never one from the message requesting the change. Payments over [$amount] need approval from [two people].

6. Reporting. Anything suspicious, including clicking a link by mistake, is reported to [name] by [phone/message]. Reports are welcome and handled without blame.

7. Working remotely. [Approved devices], screens locked when unattended, business data kept in [approved services].

8. Joining and leaving. New staff read this policy at onboarding. When someone leaves, [name] removes their access and changes any shared passwords on [the same day].

The payments rule draws on ASD’s small business guide and a 2018 Scamwatch alert, which suggested businesses “consider a multi-person approval process for transactions over a certain dollar threshold”; more detail is in the payment redirection controls guide. The joining and leaving rule reflects ASD’s note that “unless you change the password, employees could also continue accessing accounts even after they have left the business”. For account-specific steps, see securing small business cloud accounts.

Sharing and reviewing the policy

business.gov.au describes:

• consulting staff about new policies that affect them and explaining why each one matters
• documenting policies so staff can access them easily
• teaching staff the policies relevant to their role as part of onboarding
• regularly reviewing processes and procedures, including asking staff how they could be improved.

The staff security awareness guide covers short, regular ways to keep policies fresh.

Things to watch for

• Policies that don’t match reality. A rule nobody follows, or that the systems can’t support, gives a false sense of security.
• Too long to read. A short policy that staff know is usually more useful than a long one nobody opens.
• Legal and employment questions. Rules about monitoring staff, disciplinary consequences or personal devices can raise legal issues. business.gov.au notes policies help meet legal obligations, but this page isn’t legal advice.
• Forgetting contractors and suppliers. People outside the business may also use its systems; see supplier and IT provider security.
• No owner or review date. A policy without a named owner tends to go out of date.

Common questions

How do I write a cyber security policy for my small business?

A small team can start from the areas official guidance describes and keep the policy to one or two pages. business.gov.au describes a policy that clarifies staff responsibilities for data, devices, emails, websites and social media, and ASD’s small business guide adds business-specific rules such as validating invoices before paying. The one-page example policy outline brings these together with blanks to fill in. It isn’t legal advice.

What goes in a cyber security policy for a small business?

business.gov.au describes a policy that clarifies staff responsibilities for data, computers and other devices, emails, websites and social media. ASD’s small business guide adds business-specific rules such as reporting suspicious emails and validating invoices. Small teams often cover acceptable use, passwords and MFA, devices, backups, incident reporting and remote work. See the policies small teams commonly write.

Is there an official cyber security policy template for small business?

Not in the official sources used for this guide: the business.gov.au and ASD pages it draws on don’t provide a policy template. The outline on this page brings together the practices they describe, as a starting point to adapt, with square brackets for the business to fill in. See a one-page example policy outline.

What is an acceptable use policy?

An acceptable use policy sets out how business computers, internet and social media may be used. business.gov.au lists “appropriate use of computers, internet and social media” as a policy topic. One commonly covers what business devices and accounts are for, personal use if allowed, posting about the business on social media, and not installing unapproved software or browser extensions. See acceptable use.

When do I review or update a cyber security policy?

business.gov.au describes regularly reviewing processes and procedures, including asking staff how they could be improved, but doesn’t set an interval. The outline above includes a “next review” date so the business can choose its own, and a review is also a natural step after changes such as new systems or staff. See sharing and reviewing the policy.

Do I need a remote work security policy?

business.gov.au lists “working from home or remotely” as a policy topic. A remote work section commonly covers which devices may be used, locking screens, home and public Wi-Fi, and keeping business data in approved business accounts. A small business may combine it with the other areas in one document. See remote and mobile work and the working from home security guide.

Where to get official help

• business.gov.au: policies, procedures and processes
• business.gov.au cyber security checklist
• ASD’s small business cyber security guide
• OAIC: Notifiable Data Breaches scheme