A one-page cyber security policy for a small business
A cyber security policy for a UK small business doesn’t need to be a binder. This one is a single page, organised around the five Cyber Essentials controls, with each line tied to a question in the 2026 self-assessment. Add your company name, change what doesn’t match how you work, and copy, download or print it. It is a starting point to adapt, not a document the scheme makes you have.
Your cyber security policy
The .md file opens in Word, Google Docs and Notion. Nothing leaves your browser.
Cyber Security Policy — Your company
Adopted today. Applies to everyone who works for us, and to every computer, phone, tablet and online service used for our work — including personal devices used for work email, files or data.
This policy sets out how we meet the five Cyber Essentials controls. The owner is responsible for it and approves any exception in writing.
1. Firewalls. Our office network sits behind a router with a firewall, and its admin password has been changed from the one it came with. The built-in firewall is switched on on every computer, including when working from home or on public Wi-Fi. Nothing on the internet is allowed to connect in to our network unless the owner has approved it and written down the business reason; any such rule is reviewed at least every 12 months and removed when no longer needed. The router's settings cannot be reached from the internet.
2. Secure set-up. We remove or switch off software, services and user accounts we don't use, on devices and in our online services. Default and easy-to-guess passwords are changed before a device or account is used. Files do not run automatically when downloaded or when a memory stick is plugged in. Every device locks, and unlocks only with a fingerprint or face, a password, or a PIN of at least 6 characters.
3. Security updates. We only use operating systems and software that their makers still support with security updates, properly licensed. Automatic updates are switched on wherever they are offered. Security updates rated high-risk or critical — and any the maker hasn't rated — are installed within 14 days of release, on operating systems, applications and the router's firmware. Software that stops being supported is removed.
4. User access. Accounts are created only after the owner approves them, with only the access the role needs. Everyone has their own login; accounts are never shared. When someone leaves, their accounts are disabled by the end of their last day. Administrator rights are given only when the owner approves, are used from a separate account that is not used for email or web browsing, and are listed; the list is reviewed at least once a year. Multi-factor authentication is switched on for every user and administrator on every online service that offers it, with a password of at least 8 characters. Anywhere multi-factor authentication is not available, passwords are at least 12 characters. We ask for a different password for every work account, made of three or more random words, kept in the password manager we provide; we don't force regular changes or special characters. If a password or account may have been compromised, tell the owner straight away and the password is changed promptly.
5. Malware protection. Every computer runs anti-malware software that updates itself, stops malware from running and warns about malicious websites (the protection built in to Windows counts). On phones and tablets, apps come only from the official app store and only from our list of approved apps, and devices are never jailbroken or rooted.
Everyone covered by this policy is given a copy. The owner reviews it at least once a year and whenever our devices, services or people change.
Does Cyber Essentials require a cyber security policy?
No question in the 2026 (Danzell) question set asks for an overall cyber security policy, and at the basic level you don’t normally upload documents, though your certification body can ask for evidence. What the questions ask for is narrower. Some things must be written down: the business reason for any inbound firewall rule, approved by an authorised person (A4.8, A4.10). Some things must exist as a process you can describe: approving new accounts (A7.1), granting administrator access (A7.5) and changing passwords that may have been compromised (A7.13). And some things must be tracked: who has administrator accounts (A7.8) and, where you rely on approved apps, the list of them (A8.5).
A one-page policy is good practice rather than a requirement. It puts those commitments in one place, so your answers stay consistent and everyone on the team knows the rules. The question set itself says that keeping administrator accounts away from email and browsing can rest on good policy, procedure and regular training (A7.7).
How each section maps to the five controls
| Policy section | Control | Questions it speaks to |
|---|---|---|
| 1. Firewalls | Firewalls | A4.1, A4.1.1, A4.2, A4.6, A4.8, A4.9 |
| 2. Secure set-up | Secure configuration | A5.1, A5.2, A5.3, A5.8, A5.9, A5.10 |
| 3. Security updates | Security update management | A6.1–A6.6 |
| 4. User access | User access control | A7.1–A7.9, A7.11–A7.17 |
| 5. Malware protection | Malware protection | A8.1–A8.5 |
What comes from the scheme, and what is our default
Most lines restate a rule from the requirements: updates rated high-risk or critical, or not rated, within 14 days; a device PIN of at least 6 characters; no shared accounts; separate administrator accounts; firewall rules reviewed at least every 12 months. Multi-factor authentication on every cloud service that offers it, for every user and administrator, is the one to take most seriously: a single account without it fails the assessment.
Three lines are choices we made for you, and you should change them if they aren’t true:
- Leavers disabled by the end of their last day. The scheme says accounts are removed or disabled when no longer required; the last day is the habit worth committing to.
- The admin list reviewed at least once a year. The scheme says regularly, and suggests monthly, quarterly or annually depending on your business.
- Passwords of at least 12 characters where there is no MFA. The scheme also allows 8 characters where the system automatically blocks common passwords. The password guide explains the three options.
The policy says “the owner” throughout. If someone else approves accounts or looks after IT, put their role in instead.
What this policy leaves out
It covers the five Cyber Essentials controls and nothing else. Backups, for example, are sensible for any small business, but they are not a Cyber Essentials requirement, so they aren’t in this page. Add a line for anything else you do and want written down. If personal devices are used for work, pair this with the BYOD policy template.
Making it true before you adopt it
- Read each line against reality. A policy describes what happens. Where a line isn’t true yet, fix the thing or change the line. Don’t adopt a sentence you can’t stand behind.
- Switch on MFA everywhere first. The MFA guide covers what counts and where to start.
- Write the two lists the policy refers to: who has administrator accounts, and which apps are approved on phones and tablets.
- Date it and share it. Give it to everyone, and to new starters on their first day.
For more detail on one area, the user access policy and the patch management statement go deeper, and the documents guide lists the short documents worth having.
Frequently asked questions
Does Cyber Essentials require a cyber security policy?
No question in the 2026 question set asks for an overall cyber security policy. The questions do ask for specific things to be documented or tracked — the business reason for any inbound firewall rule (A4.8), who has administrator accounts (A7.8), a list of approved apps where you rely on one (A8.5) — and for processes you can describe, such as approving accounts (A7.1). A one-page policy is good practice that keeps those answers consistent.
What should a small business cyber security policy include?
For Cyber Essentials, the five controls: firewalls, secure configuration, security updates, user access and malware protection. In practice that means firewalls on and default passwords changed, unused software and accounts removed, supported software updated within 14 days, individual accounts with multi-factor authentication and separate admin accounts, and anti-malware or approved apps on every device.
Is a one-page policy enough?
For a small team, yes. The question set doesn’t ask for length; it asks whether things are true. A page everyone has read is more use than a binder nobody has.
Will adopting this policy mean I pass Cyber Essentials?
No. A policy only helps if what it says is true on every device and account, and no template can promise a pass. This is preparation guidance; certification is assessed and awarded only by an IASME-licensed certification body.
Can I edit the template?
Yes, and you should. Download it as a .md or .txt file, or copy the text, and change anything that doesn’t match how your business works — who approves accounts, how quickly leavers lose access, how often you review admin rights. Your company name stays in the page and is never stored or sent.