A cyber security policy for a small business is not a thick binder that gets filed away. It is a written agreement about how your team uses the systems that keep the business running. It should answer simple operational questions before they become urgent: who approves access, where important files are stored, what happens when a phone is lost, how a suspicious invoice is handled, and who needs to know when a problem appears.
That clarity matters because business technology is spread across email, laptops, point-of-sale systems, Wi-Fi, cloud software, cameras, phones and vendor portals. A short policy helps people make consistent decisions across all of them. The Federal Trade Commission’s small-business guidance places written policy alongside asset inventory, access controls, updates, backups and incident planning. Those are practical building blocks, not a project reserved for large companies.
Start with the work that cannot stop
Do not begin with a generic template. Begin with the workday. List the systems that would interrupt operations if they were unavailable or misused: email, customer records, payment terminals, scheduling, shared documents, camera access, business phones, remote support and the network that connects them. Include paper records and removable drives where they hold customer or business information.
For each system, name a business owner and a technical contact. The owner decides who should have access and how important the system is to operations. The technical contact knows how it is supported, updated or recovered. One person can hold both roles in a small office. The key is that the responsibility is explicit, not assumed.
This approach aligns with the NIST small-business quick-start guide, which begins with identifying the hardware, software, services and data the business relies on. A policy is more credible when it is built around that actual inventory. If an item is not important enough to list, it may not need a rule. If it is important enough to stop work, protect it on purpose.
Define who the policy applies to
State plainly who must follow the policy. That normally includes employees, owners, temporary staff, contractors and vendors who can use business information or connect to business systems. It should also state when the rules apply, including at the office, at home, while travelling and when using a personal device for approved work.
Keep the distinction between a policy and a procedure clear. The policy might say that each person uses an individual account and must report a lost device promptly. The procedure explains how a manager requests an account, disables access when someone leaves, or reports a device. NIST’s small-business guidance makes the same separation: a policy sets the written requirements, while procedures spell out who does what, when and how often.
Do not promise controls that the business does not actually use. A rule that says every laptop is encrypted, for example, is only useful if someone verifies it. Start with the controls you can consistently maintain, then add stronger requirements as the business gains the tools and habits to support them.
Set rules for accounts, passwords and access
Accounts are a good place to make the policy specific. Require individual accounts instead of shared logins for email, cloud storage, remote tools and administrator access wherever the system permits it. Use a password manager if the business has one, and do not send passwords through ordinary email or text. Require multi-factor authentication for accounts that access business data, payments, network administration or remote support.
Access should match the job. A person who runs a register needs the tools for that job, not the router administrator password. A contractor should get temporary access for a defined task, not an open-ended account. Set a rule for reviewing access after a role change, a departure or the end of a vendor project. This is one of the simplest ways to reduce forgotten access without making normal work harder.
The FTC recommends multi-factor authentication for everyone who accesses the business network and devices. If staff use personal phones to approve sign-ins, say what the business expects when a phone is changed, lost or replaced. The policy does not need to solve every exception in advance, but it should identify the person who can approve one and record the decision.
Cover devices, software and the network
Write down the minimum standard for computers, phones, tablets and network equipment used for business work. A realistic baseline may include supported operating systems, automatic updates where appropriate, screen locking, approved security software, prompt reporting of lost devices and a rule against installing unapproved programs. If personal devices can access business email or files, state the conditions clearly rather than leaving the arrangement informal.
For the network, include rules that staff can understand. The business Wi-Fi password is not for customers or casual visitors. Guest devices use a separate network. Only authorized people make changes to routers, firewalls, access points and payment equipment. Default device passwords are changed during setup, and remote administration is disabled unless there is a documented business need. Those controls support the same practical baseline covered in Matrix’s network security checklist.
Policies should support operations, not slow them down. For example, a new workstation procedure can include software updates, device naming, approved access and backup checks before the computer is handed to a staff member. That turns a policy statement into a repeatable handoff instead of a last-minute scramble.
Protect data and make backups recoverable
Identify the information the business needs to protect and continue using. This might include customer contacts, invoices, employee records, design files, camera footage, accounting data and order history. The policy should say where each type belongs, who can access it, whether it can be sent outside the business and how long it should be kept. If the business has legal, industry or customer contract requirements, have a qualified adviser confirm the rules that apply.
Backups deserve their own simple rule: which systems are backed up, where the backup is stored, who checks it and how recovery is tested. A successful backup notification is helpful, but it is not the same as restoring a usable file or system. Decide how often a sample restore will be tested and record the result. That gives the team a real recovery time to plan around instead of an assumption.
Encryption, secure disposal and physical protection should be included where they fit the information at risk. The FTC advises businesses to protect sensitive information on devices and storage media, use strong passwords and keep only the data they need. The exact approach will differ by business, which is why the policy should identify the data and the owner before it lists a technical control.
Make reporting and payment checks routine
People need a safe, fast way to report something odd. Tell staff what counts: a suspicious email, an unexpected multi-factor prompt, a lost device, a new software request, an unfamiliar charge, a call asking for access, or a change to payment instructions. Name where reports go and what the reporter should avoid doing, such as clicking a link, replying to a suspicious message or reusing a password after a suspected compromise.
Include a separate verification rule for payment and bank-detail changes. For example, the business may require an independent phone call to a known number before a vendor payment destination is changed. That is an operational safeguard, not a technical trick. It helps staff pause when an urgent-looking request arrives and gives them a known way to validate it.
Your response section should be short but useful: protect people and operations first, preserve the information needed to investigate, notify the named owner and bring in the right outside support. The FTC recommends having plans for responding to an incident, recovering operations and communicating with the people who need to know. Add business-specific legal or notification steps only after confirming the requirements that apply to your situation.
Set practical rules for remote work and vendors
Remote work and outside support should be part of the policy, not an exception to it. State which remote-access tools are approved, who can authorize them and how access is removed when work ends. Require people working away from the office to use a supported device, keep it updated, lock it when unattended and avoid exposing sensitive work over untrusted public Wi-Fi.
Vendors often need access to accounting tools, hosted phones, cameras, point-of-sale systems or network equipment. Before access is granted, record the company, individual contact, purpose, level of access, approver and end date. NIST’s CSF 2.0 quick-start guide advises small businesses to assess risks from suppliers and third parties before formal relationships. Even a simple vendor-access list makes it much easier to review what remains connected to the business.
Train, review and improve the policy
A policy only helps when people know it exists and understand what to do. Include it in onboarding, review the key points with current staff and make it easy to find. Use short, relevant reminders, such as how to report a phishing message or verify a vendor payment request. A quick discussion of a real-world scenario can be more useful than asking everyone to read a long document alone.
Set a review date and name the person responsible for it. Review earlier when the business adds a location, starts using a new payment platform, changes a key vendor, enables remote access or experiences an incident. NIST recommends reviewing risk management plans at least annually and when the business changes. After a problem, ask what created confusion and update the relevant rule or procedure while the lesson is still clear.
How Matrix Technology helps make the policy practical
Written rules are easier to follow when the business knows what equipment, accounts and support paths it has. Matrix Technology helps Las Vegas Valley businesses organize the computers, network equipment, connected systems and remote-support needs behind day-to-day operations. That can give an owner a clearer starting point for access decisions, workstation setup, vendor support and recovery planning.
If you are building a policy for the first time, begin with an inventory and a short list of the systems that would interrupt work if they failed. Matrix’s IT and networking services can help identify the operational pieces that need to be documented, while the Matrix team can discuss a practical technology-support need. For a broader review of everyday safeguards, read the small business cyber security checklist.
