Security policy

What it means

A security policy is the core document in which a company’s management sets out how information and IT systems are protected. It describes objectives, responsibilities and the main rules and refers to more detailed procedures, for example on passwords, backups or using personal devices. It is not a technical manual but a management decision about what the company considers important.

It typically covers access control, information classification, backup and recovery, email and device security including BYOD, work with suppliers, staff training and incident response. A good policy is short and understandable to people outside IT.

The policy is the first document requested by an ISO 27001 auditor or a NIS2 supervisor, but also by a bank, a large customer or an insurer offering cyber cover. Without it a company struggles to show that it manages security rather than dealing with it only when something breaks.

How it works in practice

For a smaller company a two or three-page policy and a few short procedures are enough. What matters is that the managing director approves it, that every rule has a clearly named owner and that the policy is reviewed once a year, for example when systems change or after an incident.

In an accounting firm the security policy is also a matter of client trust: we process payroll, bank statements and personal data. It must therefore state clearly who can access which client folders, how sensitive documents are sent and how long they are kept.

A policy protects nothing if people do not know it. Alongside it we recommend training on joining and once a year, plus a simple way to report a suspicious email or a lost phone. An employee afraid to admit a mistake reports it late or not at all.

What to watch out for

The most common mistake is a policy downloaded from the internet that describes processes the company does not actually have. In an inspection or insurance claim the gap between paper and reality shows up quickly, and the insurer may argue that the company did not follow its own rules.

The second is a policy without an owner. If nobody is responsible for updating it, two years later it describes systems the company no longer uses and misses new ones, such as cloud apps or generative AI into which staff may paste sensitive data.