The IT policies a ten-person business actually needs

Why fewer, shorter policies work better

Large organisations have dozens of IT policies because they have dozens of people responsible for different parts of IT, plus auditors who check each one. A ten-person accounting firm, builder or clinic has none of that. What it needs is a small set of documents that describe what the business actually does, so staff know the rules and the owner can show an insurer or customer that the basics are covered. The test for each policy is simple: would anyone notice if it were missing? If the answer is no, you probably don't need it yet. If losing it would leave staff unsure what to do during a ransomware attack or a lost laptop, you do.

Acceptable use and access

The acceptable use policy tells staff how to use work devices, email and the internet. It covers ownership of business data, reasonable personal use, installing software and handling customer information. It is the one most people will read, so keep it readable. Our separate guide on writing one goes into the detail; here the point is simply that it belongs in the set and should match how your office really works.

Alongside it, write a short access policy. It states that everyone has their own account, multi-factor authentication is required on email and anything that holds money or customer data, admin rights are limited to named people, and access is granted by role and removed on the last day of employment. Include the rule for new payees and changed bank details if you handle payments, because that is where small businesses most often lose money. One paragraph covering who approves a new account, and how it is verified, is usually enough. This document is mostly for whoever manages IT, but staff should know the headline rules.

Backup and recovery

A backup policy answers four questions: what is backed up, how often, where the copies are kept, and how quickly you expect to be working again after a failure. For many small offices the answer covers Microsoft 365 or Google Workspace data, any on-site server or NAS, and key cloud systems such as the accounting package, which may have its own export options.

The important part is the testing rule. Write down that a restore is tested at a set interval, such as quarterly, and who does it. A backup nobody has ever restored from is a hope, not a plan. Note too what is not backed up, such as files saved on laptop desktops, so staff know where to keep things.

Incident response

An incident response plan is a single page that tells people what to do when something goes wrong: a suspected hacked account, a ransomware screen, a lost laptop, a payment sent to a scammer. List who to contact first, with their email and how to reach them out of hours, what not to do (such as turning off a ransomware-affected server before someone has looked at it), and who decides whether to call the bank, the insurer or the police.

Include a line about notification. Under the Privacy Act 2020, a privacy breach that has caused or is likely to cause serious harm must be notified to the Office of the Privacy Commissioner and affected people. Your plan should name who decides whether a breach meets that bar. NCSC also accepts reports of cyber incidents, and your insurer will usually want to hear early.

Devices and remote work

A device policy covers company laptops and phones and, if you allow it, personal devices used for work. It should say that devices must have encryption, a screen lock and current updates, that lost or stolen devices are reported straight away, and that the business may remotely remove its data. If staff work from home, add the expectations for home Wi-Fi, shared family computers and printing confidential documents. Some businesses combine this with the acceptable use policy. That is fine for a small team, as long as the rules are clear and in one place staff know about.

Keeping the set manageable

Store all of these in one folder or SharePoint page, with a version date and an owner for each. In a ten-person business the owner is often the general manager or office manager, with your IT provider drafting the technical parts. Review them together once a year, ideally when you renew your cyber insurance, since the questionnaire will ask about the same topics.

If a larger customer or a government contract later asks for more formal policies, these short documents give you a solid base to expand from. Starting small and accurate beats starting big and fictional, because a policy that describes controls you don't have can cause problems with an insurance claim.