IT security policy outline

How to use it

Write one short section for each heading below. Say who owns it and when it was last reviewed. Insurers, auditors and clients ask for this document by name.

The fourteen sections

1. Acceptable use. What staff may and may not do with work devices, accounts and data.
2. Passwords and MFA. Password length, a password manager, and MFA on every account that offers it.
3. Data classification and handling. Which data is public, internal or confidential, and how each is stored and shared.
4. Incident response. Whom to tell, how fast, and the first steps when something goes wrong.
5. Access control. Who approves access, how often it is reviewed, and how it ends.
6. Remote work and VPN. How staff connect from home and from public networks.
7. Personal devices. Which personal devices may hold work data, and what each must have.
8. Email security. How staff report phishing, and how SPF, DKIM and DMARC are kept.
9. Network security. The firewall, Wi-Fi and guest network, and who may change them.
10. Physical security. Locked rooms, visitors and screen locks.
11. Vendors and third parties. How a vendor is checked before it gets your data.
12. Onboarding and offboarding. Accounts ready on day one, and access closed the hour someone leaves.
13. Backup and disaster recovery. What is backed up, how often, and when a restore was last tested.
14. Security awareness training. Who is trained, how often, and how completion is recorded.