What security policies does a small business need?
Short answer
Most small businesses need a short acceptable use policy, a password and MFA policy, a backup policy, an incident response plan, a policy on approving payments, and, increasingly, an AI use policy. Each can be one page if it is clear about who does what.
The details
Policies only help if people read them and the business follows them. Assign an owner to each, review them yearly, and connect them to something practical, such as a checklist new staff complete in their first week.
Terms explained
- Backup (3-2-1 rule)
- A backup is a separate copy of data that can be restored after deletion, failure or attack. The 3-2-1 rule means three copies, on two types of storage, with one off-site.
- Incident response
- Incident response is the organized process of preparing for, detecting, containing, eradicating and recovering from security incidents, then learning from them.
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.
Sources
Related questions
- What should a small business incident response plan include?
- What is an AI acceptable use policy and what should it cover?
- Where should a small business start with cybersecurity?
- How much should a small business spend on cybersecurity?
- Are small businesses really targeted by hackers?
- How do I train employees on cybersecurity without boring them?
Related Guides
GuideSmall Business Security
How to Write an Incident Response Plan Small Business Owners Use
Learn how to write an incident response plan small business teams can execute quickly. Protect operations, contain threats, and recover critical systems.
Read more GuideSmall Business Security
10 Small Business Cybersecurity Tips to Reduce Risk Fast
Protect your company with ten practical small business cybersecurity tips. Implement MFA, patch software, secure Wi-Fi, and build backups that work.
Read more GuideSmall Business Security
How to Implement Ransomware Prevention in a Small Business
Learn practical ransomware prevention for small businesses. Protect devices, configure offline backups, secure access, and build an effective defense plan.
Read more GuideSmall Business Security
Business Email Compromise: How It Works and How to Stop It
Learn how business email compromise attacks target finance teams and discover concrete controls, verification rules, and policies to protect your company.
Read more