← Back to Blog
Cybersecurity

How to Create a Cybersecurity Policy for Your Small Business

Most small businesses operate without a single written security policy. That is not just a risk — it is a liability in a courtroom, a void in your cyber insurance claim, and an open invitation for attackers.

By Christian Vazquez•May 5, 2025•8 min read

Why You Need It in Writing

There is a common misconception in small business that cybersecurity policy is a large-enterprise concern — something for companies with compliance departments, legal teams, and dedicated IT staff. This is wrong, and the gap between that belief and reality is costing American businesses billions of dollars every year.

Here is why the written policy is not optional:

Cyber insurance carriers require it to pay claims. This is not theoretical. Underwriters across the industry have tightened their policy language since 2021. If you file a claim after a ransomware event and you cannot produce written evidence of the security controls you represented on your application, the carrier will investigate. If your written policies do not exist or do not match your self-reported controls, the claim is denied. We have seen this happen. It is not a gray area — it is the policy language.

In litigation, the absence of a policy is an admission. After a data breach involving customer PII, the question a plaintiff's attorney will ask is straightforward: "Did you have a written cybersecurity policy?" If the answer is no, you have just confirmed that there were no documented standards, no established procedures, and no formal acknowledgment of the duty of care your customers are owed. That is negligence per se in most jurisdictions. California's CCPA and CPRA make this exposure even more acute — statutory damages of $100–$750 per consumer per incident are available without proving actual harm.

Employee accountability requires written rules. You cannot discipline — let alone terminate — an employee for a security violation that was never documented. If your acceptable use expectations live only in someone's head, they do not exist as an enforceable standard. When a breach is traced back to an employee who stored client data in their personal Google Drive, "everyone knew not to do that" is not a defense.

Compliance frameworks require written policies without exception. HIPAA's Security Rule explicitly requires covered entities and business associates to document their security policies. PCI DSS Requirement 12 is entirely dedicated to maintaining an information security policy. CMMC Level 1 requires demonstrated policy documentation. SOC 2 auditors will ask for policy artifacts as their first evidence request. If you are pursuing any of these certifications or operating under any of these regulations, the written policy is the starting point — not a nice-to-have.

The 8 Sections Every SMB Cybersecurity Policy Needs

A cybersecurity policy does not need to be a hundred-page federal procurement document. It needs to be clear, complete, and written in language your employees will actually read and understand. The following eight sections form the complete foundation for any small business security policy. Each section is a discrete document that can be packaged together under a single policy umbrella or maintained as standalone policies in a policy library.

1. Acceptable Use Policy (AUP)

What employees can and cannot do with company devices, accounts, and network access.

The AUP is the broadest policy in your library and typically the one employees encounter first during onboarding. It should address personal use limits on company-owned devices — how much is permissible, what categories are prohibited (gambling, adult content, piracy), and whether personal accounts can be accessed on company equipment. Specifically call out prohibited activities: downloading software not approved by IT, using personal cloud storage (Google Drive, Dropbox, iCloud) for company data, and visiting known-malicious categories of websites. Remote work device rules belong here as well — what happens to company data when an employee works from a personal laptop?

2. Password Policy

The minimum security standards for every credential used to access company systems, accounts, and data.

Modern password policy guidance from NIST SP 800-63B has evolved significantly. Length now matters more than complexity, but both are required in SMB environments where password managers are not yet universal. Specify a minimum of 14 characters. Require at least one uppercase letter, one number, and one special character. Prohibit reuse of the last 10 passwords. Require a password manager — IT Center provides one as part of the standard managed IT plan — so employees do not need to memorize unique complex passwords for every system. And put it in writing: credentials are never shared between users. Ever. Including between employees and IT staff.

3. Multi-Factor Authentication (MFA) Policy

The requirement for a second layer of verification before accessing any company account or system.

MFA must be mandatory — not optional, not encouraged — on all company email accounts, VPN connections, cloud applications (Microsoft 365, Google Workspace, accounting software, CRM), and financial portals. Your policy should specify the acceptable MFA methods: authenticator app (preferred), hardware security key (required for administrator accounts), or SMS one-time code (acceptable for standard users, prohibited for high-privilege access). The reason for prohibiting SMS-only on admin accounts is SIM-swapping — a social engineering attack against mobile carriers that allows an attacker to receive your SMS codes on a device they control. Authenticator apps and hardware keys are immune to SIM-swapping.

4. Remote Work and BYOD Policy

The security requirements for employees working outside the office or using personal devices to access company resources.

Remote work fundamentally changes the perimeter of your network — because there no longer is one. Your policy must require VPN for any remote access to corporate systems, internal file shares, or sensitive applications. Specify that only approved, IT-managed devices may access sensitive data categories (customer PII, financial records, attorney-client or HIPAA-covered information). For BYOD (Bring Your Own Device) arrangements, require Mobile Device Management (MDM) enrollment before the device is permitted any access — this gives IT the ability to remotely wipe company data from the device if it is lost, stolen, or the employee is terminated. Finally, prohibit the use of public WiFi networks without VPN. A coffee shop network is not a secure channel for your billing system.

5. Incident Response Policy

The documented procedure for detecting, reporting, escalating, and responding to a cybersecurity incident.

This policy answers the question every employee is afraid to ask: "What do I do if I think something went wrong?" It must specify the reporting chain with actual names, roles, and contact information. For IT Center-managed clients, the first call is always the IT Center service desk: [email protected] or (888) 221-0098. The policy must establish a reporting time window — we recommend within one hour of discovery for any suspected breach, not "when you get around to it." Delayed reporting dramatically worsens outcomes. Define the escalation chain: who is notified after the IT vendor, and in what order (CEO, legal counsel, insurance carrier). Specify the customer notification trigger — under California law, breach notification is required within 72 hours in most circumstances.

6. Data Classification Policy

A framework for categorizing company data by sensitivity level and specifying how each category must be stored, accessed, transmitted, and disposed of.

Use three tiers: Confidential (customer PII, social security numbers, payment card data, health information, passwords and credentials, financial account numbers, employee records), Internal (non-public business information that would cause harm if disclosed — contracts, strategy documents, internal communications, pricing data), and Public (marketing materials, published website content, press releases). For each tier, specify: where it may be stored (Confidential data may not be stored in personal cloud storage, ever), how it may be transmitted (Confidential data requires encrypted channels), who may access it (least-privilege basis), retention period (how long it is kept), and disposal method (secure deletion, shredding for physical records). Vague data handling is what turns a minor incident into a reportable breach.

7. Third-Party Vendor Policy

The process for evaluating, granting, managing, and revoking third-party access to company systems and data.

Your vendors represent attack surface you do not directly control. The 2020 SolarWinds compromise — which breached hundreds of organizations including federal agencies — entered through a trusted software vendor's update mechanism. Your policy must require: a signed Non-Disclosure Agreement (NDA) before any vendor accesses company data, documented business justification for each access grant, quarterly review of active vendor access with affirmative re-authorization (not passive continuation), and immediate revocation upon contract termination. For any vendor that touches health data on behalf of your organization, a Business Associate Agreement (BAA) is required under HIPAA — this is a hard legal requirement, not a best practice. The day after a vendor contract ends, their access keys, credentials, and VPN accounts are revoked. Not "when IT gets to it." The same day.

8. Social Engineering Awareness Policy

The behavioral rules that protect employees from manipulation-based attacks that bypass technical security controls entirely.

Technology stops known attacks. Social engineering exploits human psychology. This policy addresses the attack vectors that no firewall or EDR agent can block on its own. Core rules: passwords are never shared verbally over the phone — with anyone, including IT staff. IT Center will never call you and ask for your password. Ever. If someone claiming to be IT asks for your credentials, hang up and call back on a known number. Wire transfers and ACH payment changes must be verified by calling the requesting party back on a number you already have on file — never by replying to the email that requested the change. Business email compromise losses are almost entirely preventable by this one rule. All phishing emails — suspicious messages, unexpected attachments, login page redirects — must be reported to [email protected] within 30 minutes, even if the employee is not sure whether it is actually malicious. Report first, ask questions second.

The Most Common Policy Mistakes

Writing a cybersecurity policy is not the hard part. Implementing it in a way that actually changes behavior is. These are the four mistakes that turn a well-written policy into a document that sits in a shared drive folder, unread, while the organization remains just as exposed as before.

Four Policy Mistakes That Guarantee Failure

  1. Writing a 40-page policy no employee will read. Length is the enemy of compliance. If your policy cannot be read in under 20 minutes by a non-technical employee, it is too long. Use plain English. Use examples. Use bullet points. Save the technical depth for appendices that IT staff reference — not the main document your warehouse manager signs during onboarding.
  2. Distributing the policy without training on it. Emailing a PDF and collecting a signature is not training. It is documentation that you gave someone a document. Real policy training means explaining what each rule means in practice, demonstrating the consequences of violations, and confirming comprehension. Annual training is the minimum cadence — IT Center includes policy training as part of onboarding and annual security awareness programs for managed clients.
  3. No enforcement mechanism. A policy that lists prohibited behaviors but specifies no consequence for violations is not a policy — it is a suggestion. Every policy must reference the disciplinary process: first violation, second violation, and the conditions under which a violation constitutes grounds for immediate termination. HR must be involved in this language. The policy must be tied to the employee handbook.
  4. Never revisiting it after it is written. A cybersecurity policy written in 2019 does not account for Microsoft 365 Copilot, AI-generated phishing emails, or the remote-work attack surface that became standard post-2020. Policies must be treated as living documents. Review triggers should include: annual calendar date, any security incident (regardless of severity), onboarding of a major new system or cloud platform, significant regulatory changes, and any change in workforce structure (major hiring, layoffs, acquisition).

Annual Review Cadence

A cybersecurity policy that is not reviewed is a cybersecurity policy that is wrong. The threat landscape changes. Regulations change. Your business changes. Establishing a formal review cadence is itself a NIST CSF Govern function requirement.

Schedule an annual policy review date — the same time each year, treated as a non-negotiable calendar commitment at the leadership level. Outside of the annual review, any of the following events should trigger an immediate policy review and update:

IT Center conducts annual policy reviews with all managed IT clients as a scheduled service — not a billable add-on. The review includes comparing current policies against updated NIST CSF guidance, current cyber insurance underwriter checklists, and any California-specific regulatory updates that may affect the client's industry.

IT Center Writes Your Policy — Included in Managed IT

Building a cybersecurity policy from scratch is time-consuming. Getting the language right — specific enough to be enforceable, clear enough to be understood, comprehensive enough to satisfy an underwriter — typically takes an experienced information security professional 20 to 40 hours per policy set.

For clients on IT Center's managed IT plan — $300 per computer user per month, unlimited support — your initial cybersecurity policy set is written during onboarding. This is not a template with your company name substituted in. It is a custom policy document developed from your actual systems, your actual vendor relationships, your actual data types, and your actual industry's regulatory obligations. The policy is then reviewed and updated annually as part of your managed services relationship.

The policy set aligns to three standards simultaneously:

If you are a healthcare-adjacent business (covered entity or business associate under HIPAA), a payments-handling business (PCI DSS scope), a federal contractor (CMMC), or a business pursuing SOC 2 certification, IT Center's policy writing incorporates those framework-specific requirements as well.

The gap between "we have a policy" and "we do not" is the gap between a paid insurance claim and a denied one, between a defensible legal position and an admitted liability, and between an accountable workforce and one operating on informal norms that dissolve the moment they are tested. IT Center bridges that gap starting on day one.

Let IT Center Write Your Cybersecurity Policy

Your cybersecurity policy set — customized to your business, aligned to NIST CSF and your cyber insurance requirements, and reviewed annually — is included in IT Center managed IT onboarding. Contact us to get started or to request a free security assessment for your organization.

Get a Free Security Assessment