A cyber security policy for small business is a short, written document that tells your staff exactly how to handle passwords, email, devices, payments and client data — and it is the first thing an insurer, a tender panel and an auditor ask to see. This guide gives you what the policy must contain, how long it should be, and how to get staff to actually follow it in 2026.
Key takeaways
- The policy that works is two to five pages covering passwords and MFA, email and payment verification, devices, data handling, backups and incident response.
- A policy nobody has read protects nobody: ASD's ACSC logged one cybercrime report every 6 minutes in FY2024–25, and the average self-reported cost to small business was $56,600.
- Insurers and tender questionnaires increasingly require the policy to be evidenced in practice — training records, phishing results and completion logs.
- Written rules stick when they are trained monthly and measured, not when they are emailed once.
- Cyber Aware turns the policy's people rules into a working programme with automatic evidence.
What a small business cyber security policy must contain
You do not need a 40-page corporate document. You need rules your staff can remember and you can evidence. The core sections:
| Section | What it states | Why it is there |
|---|---|---|
| Passwords and MFA | Password manager required, MFA on email, finance and remote access | Blocks the credential attacks behind most breaches |
| Email and payments | Verify any payment-detail change by phone on a known number; report suspicious email in one click | Stops payment redirection and invoice fraud |
| Devices | Automatic updates on, screen lock on, lost device reported same day | Closes the lost-laptop and stale-software gaps |
| Data handling | What client data may be emailed or stored where, and what never leaves approved systems | Meets Privacy Act reasonable steps |
| Backups | What is backed up, how often, and that restore is tested | Makes ransomware survivable |
| Incident response | Who to call in the first hour, before anything else | Cuts the cost of the breach you do get |
Writing it so staff actually follow it
Most policies fail at the same point: they are written by a consultant, filed in a shared drive, and never mentioned again. Three habits change that:
- Keep each rule to one sentence a staff member can repeat. "Never approve an MFA prompt you did not trigger" beats a paragraph on multi-factor authentication architecture.
- Train the rules monthly, not once. A short module tied to each section — payment verification one month, data handling the next — keeps the rules live. Cyber Aware's security awareness training delivers this cadence automatically.
- Measure compliance, don't assume it. Phishing simulations show whether the email rules hold under pressure; completion records show who has been trained. Human risk reporting puts both on one dashboard.
The evidence problem: policy vs proof
Here is the gap most small businesses discover too late. The cyber insurance application asks whether staff receive regular training. The tender asks how the policy is enforced. The client's due-diligence questionnaire asks for training logs. In every case, the policy document answers nothing on its own — the evidence of the policy operating is what gets asked for.
That evidence has to be produced continuously: dated training completions, simulation results, report rates. A gap assessment shows where your controls stand today, and a monthly programme keeps the evidence accumulating without anyone maintaining spreadsheets.
Common mistakes
- Copying an enterprise template. Forty pages of ISO language nobody reads. Five pages you can enforce beat forty you cannot.
- No payment verification rule. Payment redirection is the costliest small-business attack and the cheapest to stop — one phone call on a known number.
- Policy without training. Signing an acknowledgement at induction is not training; the behaviour decays without monthly reinforcement.
- No owner. Name the person accountable for keeping the policy current and the evidence flowing.
- Writing it and never testing it. Run a phishing simulation within a month of publishing; the results will show which rules need another pass.
FAQ
Does a small business legally need a cyber security policy in Australia? No statute requires the document itself, but the Privacy Act requires reasonable steps to protect personal information, and a written, trained, evidenced policy is how those steps are demonstrated to regulators, insurers and courts.
How long should a small business cyber security policy be? Two to five pages. Anything longer stops being read; anything shorter misses the payment, data and incident rules that matter most.
What should the policy say about phishing? Two things: report any suspicious email with the report button in one click, and never verify a payment-detail change by email — always by phone on a number you already have.
Do insurers require a cyber security policy? Insurers increasingly ask for evidence of controls including staff training, and a policy supported by training records strengthens both eligibility and pricing. Check your insurer's current requirements.
How do I get staff to follow the policy? Train one section per month in a short module, simulate the risky behaviours monthly, and praise reports publicly. Rules that are trained and measured get followed; rules that are emailed do not.
How often should the policy be reviewed? Annually, and after any incident. The review is a good moment to run a gap assessment and confirm the controls behind each section still hold.
One last thing
The policy is the promise; the monthly training records are the proof. Insurers, clients and auditors have all learned to ask for the proof — build the programme that produces it while you write the document.