What IT Policies Does a Small Business Need? A UK Guide

By the Sound IT Policies team · Published 18 October 2026 · About a 7-minute read

Most small businesses run for years without written IT policies, until a customer, an insurer or a Cyber Essentials application asks to see them. This guide explains which policies a small UK business, typically 1–50 staff, should consider, which to start with, and how to make them something your team actually follows.

The short answer: there is no single official list. For most small firms, a sensible core is eight security policies: information security, acceptable use, access control and passwords, devices, remote working, patching and malware, backup, and incident response. As you grow, or when customers start asking, add data handling, retention, business continuity, software and cloud, joiners and leavers, suppliers and AI use.

Is There a Legal Requirement to Have IT Policies?

No UK law hands small businesses a list of IT policies they must have. But two things point firmly in that direction.

First, if you handle personal data (and almost every business does, even if it's just staff and customer contact details), UK GDPR requires you to have appropriate security in place. The ICO's guide to data security explains that this covers organisational measures as well as technical ones. Its guide to accountability and governance lists adopting and implementing data protection policies as one of the measures you can take, in proportion to what you do with personal data.

Second, other people increasingly ask. Bigger customers send security questionnaires, cyber insurers ask about your controls on proposal forms, and contracts sometimes require Cyber Essentials. Written policies are how you show that good practice isn't just in one person's head.

This guide is general information, not legal advice. If you're unsure what applies to your business, the ICO's advice for small organisations is a good, free starting point.

The Core Eight Policies Most Small Businesses Should Start With

These cover the everyday risks: people, accounts, devices, updates, backups and what to do when something goes wrong. They also line up with the areas that customer questionnaires and the NCSC's small organisations guide to cyber security focus on.

Information security policy. The umbrella document. It says who is responsible for security, what the business commits to, and how the other policies fit together. It's often the first document a questionnaire asks for.
Acceptable use policy. Plain rules for using company email, internet, devices and messaging, including how to spot and report phishing.
Access control and password policy. Who gets access to what, keeping admin accounts separate, using a password manager, and turning on multi-factor authentication (MFA).
Device and BYOD policy. Rules for company laptops and phones, and for personal devices used for work: screen locks, encryption, updates, and what happens if one is lost.
Remote and hybrid working policy. Working safely from home and on the move: home Wi-Fi, public networks, screen privacy and printing.
Patching, malware and secure configuration policy. Keeping software up to date, removing what's no longer supported, using anti-malware and changing default settings.
Backup and recovery policy. What gets backed up, how often, where copies are kept (including one that ransomware can't reach), and how often you test a restore.
Incident response policy and plan. Who staff tell, the first steps to take, how incidents are logged, and how to decide whether a personal data breach must be reported to the ICO. Reportable breaches must be reported within 72 hours of becoming aware of them, as the ICO explains on its report a breach page.

Seven More Policies That Round Out a Well-Run Business

You don't need all of these on day one. They become more useful as you take on staff, suppliers and larger customers, and questionnaires often ask about them.

Data protection handling: day-to-day rules for storing, sharing and labelling personal and confidential information. This is operational guidance, not a privacy notice.
Data retention and secure disposal: how long you keep things and how you get rid of files, paper and old devices safely.
Business continuity and IT resilience: how you keep trading through an IT outage, a supplier failure or losing your office.
Software, licensing and cloud services: which apps are approved, how new ones get added, and avoiding "shadow IT".
Joiners, movers and leavers: setting up, changing and removing access and equipment when people start, change roles or leave. Questionnaires check this a lot.
Supplier and third-party IT security: checking the IT providers and cloud services that hold your data or can access your systems.
AI use: which AI tools staff may use, what information must never go into them, and checking what they produce.

One more item to be aware of: since 19 June 2026, organisations must have a way of handling data protection complaints, including acknowledging them within 30 days. The ICO explains what's needed in how to deal with data protection complaints. It doesn't need to be long, but it does need to exist.

What Usually Triggers the Need

Policies rarely get written for their own sake. These are the usual prompts:

A customer security questionnaire. A larger customer asks how you protect their data, and often asks you to attach your policies.
Cyber Essentials. The assessment is about technical controls, but you'll find it much easier to answer accurately if your processes are written down.
Cyber insurance. Proposal forms ask about MFA, backups, patching and incident plans. Your answers matter, so they should match what you actually do.
Growth. Once you have more than a handful of people, "everyone just knows" stops working.

How Many Policies Is Too Many?

A small business doesn't need a shelf of documents written for a bank. A short policy that matches what you really do beats a long one that nobody reads or follows. If a rule in a template doesn't fit your business, change it or delete it. A policy that promises something you don't do is a bigger problem than a simple one, because your answers to customers, insurers and assessors should match what really happens.

A practical rule of thumb: start with the core eight, make each one fit your business, and add the others when a trigger comes along or when you notice a gap.

What a Good Policy Looks Like

Whatever you use, whether you write your own, adapt a template or have someone draft them for you, check that each policy has:

a named owner (a role, such as "Operations Manager", is fine)
a version number, approval date and next review date
a clear scope: who and what it applies to
short, specific rules written in plain English, saying "we do X", not "it is recommended that consideration be given to X"
what staff should do if they can't follow a rule, or spot a problem

Putting Your Policies Into Practice

A policy only helps if people know about it. Keep the rollout simple:

Tailor: replace the generic parts with your real systems, roles and suppliers.
Approve: have a director or owner sign them off.
Brief: walk staff through the rules that affect them, ideally in under 30 minutes.
Record: ask staff to confirm they've read the policies, and keep the record.
Review: look at them at least once a year, and after any incident or big change, such as moving to a new email system.

Keep a simple register of your policies, with their owners and review dates, so they don't quietly go out of date.

Where to Start This Week

If you're not sure where your gaps are, start with an honest check of what you already do. Our free Cyber Essentials and IT policy readiness checklist takes about 15 minutes. It covers the five Cyber Essentials technical controls plus backups, and shows which policy covers each gap.

Common Questions

Can We Combine Policies Into One Document?

Yes. Some small businesses keep a single "IT and security handbook" with a section for each topic. That's fine, as long as each section still has clear rules, an owner and a review date. Separate documents are easier to send when a customer asks for one specific policy, which is why many firms keep them apart.

Do Sole Traders Need IT Policies?

If it's just you, a full set of policies is usually overkill. A short written note of how you handle passwords, updates, backups and incidents is still worth having, because customers and insurers may ask the same questions whatever your size.

Is a Privacy Notice an IT Policy?

No. A privacy notice tells people outside your business how you use their personal data. IT policies tell your own staff how to work securely. You may need both, and the ICO has guidance on privacy notices.

Sources

Official guidance referred to in this guide (checked 18 October 2026):

Important: this guide is general information, not legal advice, certification or a guarantee of compliance with any standard, contract or law. Check the current official guidance linked above, and take qualified advice where you need it. Cyber Essentials is a UK Government scheme run by the NCSC and delivered by IASME. Sound IT Policies is not affiliated with or endorsed by the NCSC, IASME or the ICO.

More Guides

All guides · Sound IT Policies home