Security Policies That Prevent Incidents

Security Policies That Prevent Incidents

Photo by Mikhail Nilov on Pexels

Technology alone cannot secure your business. You need policies — simple, written rules that everyone follows. A security policy does not need to be a 50-page document. It needs to be clear, practical, and enforced.

The Essential Security Policies for Small Business

1. Acceptable Use Policy (AUP)

Defines what employees can and cannot do with company devices and accounts. Keep it to one page:

• Company devices are for company business only
• No personal software installation without IT approval
• No sharing of passwords or credentials
• No using company email for personal accounts (banking, social media)
• Devices must be locked when unattended
• Report lost or stolen devices immediately

Have every employee sign the AUP during onboarding and annually thereafter. A signed AUP is also required by most cyber insurance policies.

2. Password Policy

As covered earlier, passwords are the number one attack vector. Your password policy should require:

• Use of a company-approved password manager
• Unique password for every account (no reuse)
• Minimum 16 characters for the password manager master password
• MFA enabled on all business accounts
• No passwords written on paper, stored in documents, or saved in browsers

3. Access Control Policy

Defines who has access to what. The principle is least privilege — employees should have access only to what they need to do their job, nothing more.

• Review access permissions quarterly
• Remove access when someone changes roles
• Disable all accounts within 1 hour of an employee leaving
• Admin accounts are separate from daily-use accounts
• Shared accounts are prohibited — every person has their own login

4. Incident Response Plan

This is your "what do we do when something goes wrong" document. It should fit on one page and answer: who do we call, what do we do first, how do we contain it, and how do we recover.

1. Detect — How will we know something happened? (Monitoring, employee reports, customer complaints)
2. Contain — Disconnect affected systems, change passwords, block the attacker's access
3. Assess — What was affected? What data was accessed? What systems were compromised?
4. Notify — Who needs to know? (Insurance, customers, regulators if applicable)
5. Recover — Restore from backups, rebuild systems, verify integrity
6. Review — What went wrong? How do we prevent it from happening again?

Keep this document where you can find it in a crisis — not on the server that just got encrypted by ransomware.

5. Data Classification Policy

Not all data needs the same level of protection. Classify your data:

• Public — Website, marketing materials. No restrictions
• Internal — Internal documents, procedures. Employees only
• Confidential — Client data, financial records, personnel files. Restricted access, encrypted
• Regulated — HIPAA, CMMC, PCI data. Must comply with specific regulations

The Offboarding Checklist

The most common security gap in small businesses is offboarding. When an employee leaves, their access is often not fully revoked. Create a checklist:

• Disable email account (within 1 hour)
• Disable VPN and remote access
• Disable local computer accounts
• Change shared passwords they had access to
• Revoke password manager access
• Revoke cloud application access (CRM, accounting, etc.)
• Recover company devices (laptop, phone, keys)
• Audit for any personal accounts created with company email
• Forward their email to a manager for 30 days (to catch vendor communications)

Key Takeaways

• Security policies do not need to be long — they need to be clear, signed, and enforced
• The Acceptable Use Policy, Password Policy, and Incident Response Plan are the minimum three
• Least privilege access means employees can only access what they need
• Offboarding is the most common security gap — have a checklist and follow it within 1 hour
• Keep your Incident Response Plan somewhere accessible even when your network is down