How to Write a Cyber Security Policy

Cyber security is protecting computer systems and networks from attacks. Cyber security methods range from straightforward (password management, for example) to complex digital safeguards working behind the scenes. This variety is necessary because of the complexity of modern digital systems and the scope of cyber-attacks.

A policy gives staff clear instructions, but it must work alongside technical controls and an easy way to report concerns. The NCSC’s Cyber Essentials requirements group their baseline technical controls into five areas:

• Firewalls
• Secure configuration
• Security update management
• User access control
• Malware protection

A written policy does not, by itself, provide Cyber Essentials certification.

Organisations of every size face cyber threats. A policy helps assign responsibility for managing systems, explains everyday security rules and sets out how to escalate an incident. The controls it describes should reflect the organisation’s systems, data and risks.

In the Cyber Security Breaches Survey 2025/26, 43% of UK businesses and 28% of charities reported identifying a cyber security breach or attack in the preceding 12 months. These figures include attempted attacks, not just incidents that led to a loss.

Reported exposure differed by size: 42% of micro businesses, 46% of small businesses, 65% of medium businesses and 69% of large businesses identified a breach or attack. Smaller organisations should still prepare for disruption and data loss, even if they identify fewer incidents.

The survey also found that only 25% of businesses had a formal incident response plan. A short, usable policy can give staff a reporting route and identify the people responsible for containing an incident and making decisions.

The UK GDPR and Data Protection Act 2018 require organisations that process personal data to use security measures appropriate to the risks. The Data (Use and Access) Act 2025 has since amended parts of UK data protection law. These duties cover personal data about staff and other individuals as well as customers. A policy can describe who is responsible for protecting it, but the organisation must also put the measures into practice and review whether they work. See these data protection methods for related practical controls.

An incident does not automatically have to be reported to the Information Commissioner’s Office (ICO). Under the UK GDPR, a personal data breach must be reported to the ICO unless it is unlikely to result in a risk to individuals’ rights and freedoms. Reportable breaches must be notified without undue delay and, where feasible, within 72 hours of becoming aware of them; a high-risk breach may also require informing affected people. The ICO says organisations must record personal data breaches even when notification is not required. Your policy should name who assesses the risk, keeps the record and makes any notification.

The UK’s Network and Information Systems Regulations 2018 place additional cyber security duties on certain essential service operators and relevant digital service providers. The UK’s Cyber Security and Resilience Bill proposes changes to that framework but has not yet become law.

NIS2 is an EU directive, not a blanket UK requirement. A UK-based business may nevertheless need to assess the national NIS2 rules of an EU country if its EU operations or services fall within scope. Sector, size, services and local implementation matter, so any applicable requirements should be reflected in its security and incident response procedures.

Start with the context. Employees are more likely to follow a policy if they understand why it exists, so explain why your organisation needs one. Defining roles and responsibilities also helps buy-in, so include this early.

You should also explain the terms and jargon in the policy so everyone can follow it. As with any policy, it must also outline who and what it applies to. Employees, contractors and any other third parties who work with your systems must recognise your policy’s coverage.

Specify which devices, cloud services and information are covered. Name the people who approve security decisions, administer systems and assess incidents. The ICO recommends a risk-based approach to organisational and technical measures; the level of detail should suit the organisation and the data it handles.

Set rules for account sign-in that staff can follow in practice. Require unique passwords for accounts that use them, provide an approved password manager where appropriate and explain how to report a suspected compromised password.

Avoid mandatory character mixtures and routine password expiry: the NCSC’s current requirements support longer, unique passwords and say not to enforce regular expiry. Specify multi-factor authentication (MFA), especially for administrative and internet-accessible accounts, and use passkeys or other supported passwordless options where suitable. For more detail, see our guide to password security.

Access control stops unauthorised users from getting to sensitive information or systems. Spell out who can access what and who has the authority to grant or revoke privileges. This safeguard helps keep bad actors out of your systems. It makes it less likely employees will mistakenly access something they shouldn’t.

Limit privileges to what each role needs, review access when staff change roles or leave and use separate administrative accounts for privileged tasks. For Cyber Essentials, organisational cloud services and accounts owned by the organisation are within the assessment scope even when a provider or contractor helps manage them.

It’s more helpful for non-scientists to look at how stress affects our thoughts or feelings, which is where the Perceived Stress Scale comes in.

Your emails are a potential vulnerability since they’re mainly handled by real humans. And humans can be fooled into opening malicious links or attachments – a style of attack known as phishing.

Explain how staff should report suspicious emails and what to do if they have opened a link or attachment.

Tell staff to verify unexpected payment or data requests using a known, separate contact route. Explain what to do if credentials have been entered or a file downloaded.

State who inventories devices and software, checks that they remain supported and installs security updates from trusted sources. Where an organisation is seeking Cyber Essentials certification, its requirements set a 14-day deadline for specified high-risk or critical vulnerability fixes. Explain the update process for managed devices and tell staff to verify unexpected update prompts with IT.

Backups support recovery after accidental deletion, ransomware or system failure. Set out what is backed up, how often, who is responsible, how backup copies are protected and how restoration is tested. The NCSC recommends backups, although they are not one of Cyber Essentials’ five technical requirements. Staff should know how to request recovery without using an unapproved storage service.

An incident response plan should make it easy to act quickly and preserve the information needed to investigate. Include reporting contacts, an out-of-hours route where relevant and the person authorised to direct containment, recovery and communications.

Explain reporting procedures and make it clear who needs to know what. Responsibilities need to be defined, too. Adding more detail to this section will lead to a faster and more efficient response in practice.

Set out how the team assesses whether personal data is affected, makes notification decisions and documents the reasons. Link to a fuller response plan if the steps would make the staff policy unwieldy.

Working away from the office requires clear rules for devices, networks and cloud accounts. State which personal devices are permitted, whether a managed VPN is required, how devices are locked and updated and how lost devices are reported. The Cyber Essentials scope normally includes home-working and permitted personal devices used to access organisational data or services, subject to its specified exclusions.

Publish the policy where staff can find it, explain it during induction and make it easy to ask questions or report a mistake. Record that staff have received it; an acknowledgement can support this but cannot show on its own that the controls work.

Name a policy owner and set a review date. Review it earlier if there is a material change to systems, suppliers, legal duties or incidents. Check that the instructions match actual practice and that technical measures still work.

Use this short template as a starting point. Replace every bracketed field and adapt the rules to your systems, risks and any sector-specific duties.

☐  Confirm the policy owner, approval, scope and incident contact details.

☐  Match the rules to an inventory of devices, software, cloud services and important data.

☐  Check the five Cyber Essentials control areas against the current requirements if seeking certification; include backup arrangements as a separate recovery measure.

☐  Define access, MFA, password or passkey, update, supplier and remote-working procedures.

☐  Set up internal incident reporting, breach records, an ICO notification decision process and any applicable sector or EU reporting procedures.

☐  Share the policy with staff, explain their roles, test the response and recovery arrangements and set a review date.

Staff need to understand the rules they are expected to follow and how to report concerns. Include induction and refresher learning appropriate to their roles, covering suspicious messages, account security, safe use of systems and incident reporting. The ICO recommends appropriate initial and refresher training for people who handle personal data. Its effectiveness depends on clear procedures and working technical controls as well as course completion.

The online Cyber Security Awareness course introduces common threats, including phishing and social engineering, and everyday actions staff can take. For guidance on choosing and managing an ongoing programme, read the security awareness training platform guide.

Training supports a policy when staff can apply what they learn within the organisation’s procedures. Online awareness training cannot replace technical controls, organisation-specific procedures or checks that staff can apply the guidance in practice.