IT security policy template
An IT security policy (or information security policy) sets out how your company protects its systems and data: who is responsible, what's in scope, the standards you meet and how you check them. This free Word template, for companies of 10 to 250 people, is built around the five technical controls of Cyber Essentials, the government-backed scheme from the UK's National Cyber Security Centre (NCSC).
Running a company of 30 to 200 people? Documents like this are now worth money.
It covers what the company does. Each person's rules belong in the acceptable use policy, and what to do during an attack in the incident response plan.
What's in the template
Information security policy
| Company | |
|---|---|
| Accountable director | |
| Policy owner | Day-to-day lead, in-house or at your IT provider |
| Cyber Essentials | Level, certificate number and expiry, or target date |
| Version, date and next review |
1. Scope
Everything that holds or reaches company data: offices, home working, company devices, personal devices used for work, cloud services, and accounts used by IT suppliers.
2. Responsibilities
| Who | Responsible for |
|---|---|
| Board | Approving this policy, accepting residual risks, funding fixes |
| Policy owner | Keeping controls in place; quarterly board report |
| IT lead or provider | Configuring, updating and monitoring systems |
| Managers | Approving access; telling IT about joiners, movers and leavers |
| Staff | Following the acceptable use policy; reporting incidents |
3. Technical controls
| Control | Our standard | Owner | How checked |
|---|---|---|---|
| Firewalls | Every device protected; default admin passwords changed; admin interfaces closed to the internet unless documented and extra-protected; inbound rules approved and pruned | ||
| Secure configuration | Unused accounts and software removed; auto-run off; devices lock and limit password guessing | ||
| Security update management | Licensed, supported software only; automatic updates on; critical and high-risk fixes within 14 days | ||
| User access control | Approved, individual accounts; MFA on every cloud service; separate admin accounts; access removed when no longer needed | ||
| Malware protection | Up-to-date anti-malware that blocks malicious websites, or application allow listing |
4. Sign-in standards
- Multi-factor authentication (MFA) wherever available; passkeys where offered
- Without MFA: at least 12 characters, or 8 plus a block list of common passwords
- No forced expiry or complexity rules; a password manager for everyone
- Passwords changed at once if compromise is suspected
5. Assets and backups
- Register of devices, software and cloud services, checked [quarterly]
- Data the business needs is backed up, with one copy kept apart from the network
- Restores tested [quarterly]; see the disaster recovery plan
6. Suppliers
- Security checked before contracts are signed
- Supplier accounts named, protected by MFA and reviewed
- Contracts state which controls the supplier provides
7. People and incidents
- Security briefing at induction and yearly
- Acceptable use policy acknowledged by every user
- Incidents handled under the incident response plan
8. Exceptions
| Exception | Reason and safeguard | Approved by | Review date |
|---|---|---|---|
How to write an IT security policy
- Start with an asset list and set the scope from it. Cyber Essentials requires end-user devices and cloud services in scope, including personal devices that access company data or services, except phones used only for calls, texts or authenticator apps.
- Name an accountable director and a policy owner, even if an IT provider does the work; its accounts on your systems are in scope too.
- Set a standard for each control from the current requirements (version 3.3, for assessments from 27 April 2026), and turn gaps into dated actions.
- Add what Cyber Essentials leaves out. Backups aren't one of its technical requirements, though the NCSC highly recommends them; its Small organisations guide also covers accounts and scams.
- Record exceptions with the reason, the safeguard and the approving director, and review the policy yearly.
Which document does what
| IT security policy | Acceptable use policy | Incident response plan | |
|---|---|---|---|
| For | Directors, IT lead, IT provider | Every user | The incident team |
| Says | Which controls the company maintains, and who owns them | What each person may and may not do | What to do during an attack or breach |
| Sample line | "Critical updates installed within 14 days" | "Lock your screen when you leave it" | "Isolate the infected laptop, then call the incident lead" |
Keeping them separate keeps each one short.
What the NCSC and ICO say
- Cyber Essentials. The NCSC describes it as the minimum standard of cyber security the government recommends for organisations of every size. Cyber Essentials Plus adds more rigorous independent testing of the same five controls.
- Guidance by size. The NCSC's Small organisations guide is for organisations with up to 49 employees; its 10 Steps to Cyber Security is aimed at medium and large ones with someone dedicated to cyber security.
- Personal data. Article 32 of UK GDPR requires security appropriate to the risk. The ICO calls meeting the Cyber Essentials requirements a good starting point, but only a base set of controls.
Example: a fictional 95-person engineering consultancy
A fictional consultancy checked itself against the control table before applying for certification:
| Gap | Control | Fix | Owner |
|---|---|---|---|
| Four laptops on an unsupported operating system | Security update management | Replaced; register now shows support end dates | IT provider |
| MFA off on the cloud accounting system | User access control | Turned on for all 12 users | Finance manager |
| Router admin page reachable from the internet | Firewalls | Closed to the internet | IT provider |
| Site engineers reading email on unlocked personal phones | Secure configuration | Device management enforcing a screen lock | IT provider |
Two lab machines that can't be updated now sit on an isolated network with no internet access, recorded as an exception signed off by the managing director.
Common mistakes
- A long policy borrowed from a large company that nobody can follow or check.
- A scope that stops at the office door, missing cloud services, home workers or the IT provider's accounts.
- Assuming the cloud provider does everything. Cyber Essentials expects a contractual commitment for any control it runs for you.
- No exception register, so the unpatchable machine is forgotten, not isolated.
Frequently asked questions
Is an IT security policy a legal requirement?
Not as such. UK GDPR requires security appropriate to the risk for personal data, and the ICO says whether you need a formal policy depends on your size, though one helps you show how you comply.
Do we need Cyber Essentials certification?
It isn't a legal requirement for most companies, but the NCSC recommends it as the minimum standard for organisations of all sizes, and certification gives customers independent evidence of the five controls.
How often should the policy be reviewed?
At least yearly, and when the Cyber Essentials requirements change: version 3.2 applied from 28 April 2025 and version 3.3 from 27 April 2026.
The template is a framework, not legal or professional advice; have your IT provider check it against your set-up.
Sources
- NCSC: Cyber Essentials overview
- NCSC: Cyber Essentials, Requirements for IT Infrastructure v3.3 (April 2026)
- NCSC: Cyber Essentials resources
- NCSC: Small organisations guide to cyber security
- NCSC: 10 Steps to Cyber Security
- ICO: A guide to data security
- legislation.gov.uk: UK GDPR, Article 32 (security of processing)