What makes a good Cyber Security Policy?

A cyber security policy is a set of guidelines and procedures that an organisation uses to protect its digital assets from cyber threats. A cyber security policy typically covers access control, password management, network security, data protection, incident response, and disaster recovery.

Why does an SME need a cyber security policy?

First, it helps to protect your business from cyber attacks that could result in financial loss, damage to reputation, or legal liability. It ensures that everyone in the organisation understands their role in protecting its digital assets and helps establish a security culture.

Second, regulations and standards such as GDPR or ISO 27001 often require a cyber security policy. This helps to demonstrate to customers, partners, and investors that your business takes cyber security seriously and is committed to protecting their data.

Finally, a cyber security policy helps ensure that everyone in the organisation is on the same page regarding cyber security by establishing clear guidelines and procedures. In addition, a cyber security policy makes it easier for employees to understand their responsibilities and reduces the risk of confusion or ambiguity.

Recognising that cyber security is critical to your business operations is essential. However, suppose you are unsure of your knowledge of cyber security. In that case, you may consider working with our Cyber Essentials Partners to develop a policy tailored to your organisation's needs.

The 2023 Cyber Security Breaches survey showed 30% of businesses don't have a Password Policy that ensures that users set strong passwords, with only 31% of businesses having a policy which enforces a rule that employees should apply software security updates within 14 days.

Just 29% of Businesses say they have a formal policy covering cyber security risks - 2023 CSBS Survey

What should your cyber security policy cover?

Below are the vital elements of any good cyber security policy:

Risk Assessment: A Cyber risk assessment should consider the type of data the SME handles, the systems and networks used to store and process that data, and the potential impact of a cyber-attack.
Access Control: A good cyber security policy should specify who has access to what data and systems and the procedures for granting, modifying, and revoking access privileges.
Password Management: A good cyber security policy should include guidelines for password creation, complexity, expiration, and storage.
Employee Training: A good cyber security policy should include regular training on cyber threats, phishing scams, and other common attack vectors.
Incident Response: A good cyber security policy should include procedures for detecting, reporting, and responding to security incidents, as well as for documenting and reporting them.
Backups and Disaster Recovery: A good cyber security policy should specify backup and recovery procedures and procedures for testing and updating disaster recovery plans.
Compliance: An excellent cyber security policy should ensure compliance with relevant laws and regulations and industry best practices.

The Cyber Resilience Centre offers a range of Cyber Security Policy templates as part of our paid memberships. Our Cyber Security Consultants have designed these templates to help your staff put the proper measures in place to ensure your business has clear security strategies and can respond efficiently if a cyber incident occurs.

I already have some of those policies implemented; how do I consider this with my new cyber security policy?

While it is possible to spread the content of a cyber security policy across other business policies, having a dedicated cyber security policy for an SME is generally recommended. This is because cybersecurity requires unique guidelines and procedures that other business policies may not cover.

Having a separate cyber security policy allows an SME to communicate the specific measures and protocols that need to be taken to protect their data and systems. The cyber security policy should be reviewed regularly and updated to ensure it remains relevant and effective in protecting the SME from cyber threats. However, it is essential to ensure that the cyber security policy is consistent with other business policies to avoid contradictions or gaps in coverage:

Example 1: My Business already has a Password Policy

Suppose your business already has a password policy that covers the essential elements of password creation, complexity, expiration, and storage. In that case, there is no need to duplicate this content in your cyber security policy. Instead, you can refer to the existing password policy and ensure the two policies are consistent.

Example 2: My Business has an Employee Conduct Policy

Suppose your business already has a policy for employee conduct or acceptable use of technology. In that case, your cyber security policy should refer to this policy and reinforce the importance of complying with it. The cyber security policy can also provide additional guidelines and procedures specific to cyber security, such as guidelines for avoiding phishing scams or using secure remote access.

Example 3: My Business already has an Incident Management Policy

Suppose your business already has a policy for incident management or disaster recovery. In that case, your cyber security policy can refer to this policy and provide additional procedures and guidelines specific to cyber incidents or cyber disasters. For example, this can include guidelines for reporting cyber incidents, communicating with stakeholders, and restoring systems and data after a cyber attack.

It is more important than ever for your business to have policies and a cyber security plan.

To further support businesses, we have created a Cyber Incident Response Pack containing documents to help keep your business plan for responding to a cyber incident. These documents are designed to complement any existing plans or assist you in creating one.