IT Policies and Procedures: The 10 Every Small Business Needs
IT policies and procedures are the written rules for how your company uses technology, plus the step-by-step instructions for following them. Policies say what must happen and why ("all accounts use MFA"). Procedures say exactly how ("open the Authenticator app, scan the code, test it"). Every small business needs at least an acceptable use policy, an information security policy, a password and MFA policy, an email security policy, a backup policy, and an incident response plan.
I'll be honest. Nobody gets into business because they're excited to write IT policies. You started a company to do architecture, or accounting, or dentistry, not to define "acceptable use" for the office Wi-Fi. But here's the thing. Every company already has IT policies. Most of them just aren't written down. They live in one person's head, and that person is on vacation the week the bank calls about a strange wire transfer.
TL;DR: Write short policies that fit on one or two pages each. Back each policy with a procedure people can actually follow. Enforce what you can with technology. Signatures alone won't do it. Review everything once a year. Start with the ten below, in roughly this order.
What Are IT Policies and Procedures?
IT policies are high-level rules. They define what's expected, why it matters, and who it applies to. "Company data may only be stored in approved company systems" is a policy.
IT procedures are the instructions that make the policy happen. "To share a file with a client, upload it to the client's SharePoint folder, select Share, choose Specific people, and set an expiration date" is a procedure.
You'll also hear about standards (specific requirements, like "passwords must be at least 14 characters") and guidelines (recommendations, like "use a passphrase you can remember"). For a small business, policies and procedures do most of the work.
Why IT Policies Matter for a Small Business
Three reasons, and none of them is "because an auditor said so."
People need to know the rules. You can't hold someone accountable for a rule nobody wrote down. "I didn't know I couldn't use my personal Gmail for client files" is a fair defense when it's true.
Attackers go after people. Verizon's 2025 Data Breach Investigations Report found credential abuse was the leading initial attack vector, at 22% of breaches. Password, MFA, and email policies target exactly that.
Someone will ask. Cyber insurers, big clients, and regulators all want to see written policies now. The FTC's Safeguards Rule, for example, requires covered financial businesses (including many tax preparers and auto dealers) to have a written information security program. Our cyber insurance readiness quiz shows what insurers typically look for.
The 10 IT Policies Every Small Business Needs
1. Acceptable Use Policy
What staff may and may not do with company computers, email, internet, and Wi-Fi. Personal use, prohibited sites, installing software, and the reminder that company systems may be monitored. This is the one everyone signs.
2. Information Security Policy
The umbrella policy. It states that the company protects its data, names who is responsible, and points to the other policies. More on what goes in it below.
3. Password and MFA Policy
Minimum password length (14 or more characters is a good bar), no reuse across sites, a company password manager, and MFA on every account that supports it. Start with email, banking, payroll, and remote access.
4. Email Security Policy
How to spot and report phishing, what never gets sent by email (Social Security numbers, full card numbers, passwords), and the most important line in the whole policy: any request to change bank details or send money gets verified by phone, using a number you already have. Not the number in the email.
5. Data Classification and Handling Policy
Sort data into simple buckets, like Public, Internal, and Confidential, and say where each kind may be stored and how it may be shared. Confidential client files don't go to personal Dropbox accounts.
6. Remote Work and BYOD Policy
Rules for working from home, public Wi-Fi, and using personal phones or laptops for work. Our BYOD policy guide has a full template for the personal device part.
7. Backup and Disaster Recovery Policy
What gets backed up, how often, where the copies live, how long they're kept, and how often restores are tested. "We back up" is not a policy. "We back up nightly, keep 90 days, keep one copy offline, and test a restore every quarter" is.
8. Incident Response Plan
What staff do when something looks wrong, who they call, and who decides what happens next. Include phone numbers on paper. If ransomware takes down email, the plan stored in email isn't much help.
9. Patch and Lifecycle Management Policy
How quickly updates get installed, and when hardware and software get replaced. Critical security updates within days. Devices replaced on a schedule. Nothing running past its end-of-support date.
10. Access Control and Offboarding Policy
Who gets access to what, who approves it, and how access is removed when someone leaves. This one gets its own section below, because it's the procedure most businesses skip.
As you grow, you'll add change management, vendor management, asset management, and an AI use policy. Start with these ten.
Information Security Policy Document Example
Here's a simple outline you can adapt. Most small business versions run two to four pages.
Purpose. Why the policy exists. "To protect company, client, and employee information from loss, theft, and misuse."
Scope. Who and what it covers. All employees, contractors, devices, and systems that access company data.
Roles. Who owns security (for example, the operations manager), who manages IT (internal or your MSP), and what every employee is responsible for.
Policy statements. Short, clear rules. For example: all company accounts use MFA, company data is stored only in approved systems, laptops are encrypted and lock after 10 minutes, and incidents are reported to IT immediately, with no blame for reporting.
Related policies. Links to the acceptable use, password, email, backup, and incident response policies.
Enforcement. What happens if the policy isn't followed.
Review. The owner and the next review date.
Don't want to start from a blank page? SANS and the Cybersecurity Risk Foundation have published a library of free cybersecurity and information security policy templates. They're written for larger organizations, so trim hard. A 20-person office doesn't need 30 pages on mainframe security.
What Every IT Policy Should Include
Whatever the topic, each policy needs the same few parts:
A clear purpose in one or two sentences
Who it applies to
The actual rules, written in plain English
Who owns the policy and who enforces it
What happens when someone breaks it
The date it was approved and the date it gets reviewed
If a policy needs a glossary to understand, rewrite it. If your office manager can't explain it in one sentence, nobody will follow it.
Procedures People Actually Use
A policy is only as good as the procedure behind it. The best procedures are short, numbered, and live where people need them: a pinned page in Teams, a laminated card by the printer, a link in the onboarding email.
Here's one I'll defend all day. Every "my computer isn't working" procedure should start with the same step: restart it. The computer, the app, or the router. It sounds too simple to write down. But a huge share of "the system is down" calls clear up with a restart, and even technical people forget to try it when they're stressed. Writing it down as step one saves everyone time, including us.
That's my one strong opinion in this post, and yes, it's an IT company telling you how to call IT less. If the restart doesn't fix it, then call. That's what the helpdesk is for.
The Procedure Nobody Writes: Offboarding
When an employee leaves, someone needs to do all of this, the same day:
Disable their Microsoft 365 or Google account and sign them out everywhere.
Reset any shared passwords they knew.
Remove them from MFA, VPN, and every app with its own login.
Transfer their files and email to their manager.
Collect the laptop, phone, and building keys.
Remove them as owner or admin on any system, including social media and the domain registrar.
Skip step six and you'll learn about it eighteen months later, when the company website renewal goes to their personal email and nobody can log in.
Why a Lifecycle Policy Saves You From the Server in the Closet
A pattern I've seen at a lot of small businesses: a server or core app that's past its end-of-life date. That means no more security patches, ever, for anything found from that day forward.
It doesn't fail the day support ends. It keeps working for months, sometimes years, while quietly collecting unpatched holes. Everyone forgets it's there, like the treadmill in the guest room. Then one of those holes gets used.
A patch and lifecycle policy fixes this the boring way. Keep a list of every system with its end-of-support date. Plan the upgrade a year ahead. Our post on Server 2012 R2 end of life shows what that looks like in practice.
Let the Technology Enforce Your IT Policies
A policy without a setting is a suggestion. Wherever you can, make the system enforce the rule:
MFA policy: turn on MFA requirements in Microsoft 365 so nobody can opt out.
Device policy: use Microsoft Intune to require encryption, screen locks, and updates.
Data policy: use sharing settings and data loss prevention to block files from going to personal accounts.
Email policy: add a banner on external emails and filter known phishing.
Signatures still matter. They prove people were told. But the setting is what stops the mistake at 4:55 on a Friday.
How to Roll Out IT Policies Without a Revolt
Start small. Acceptable use, password and MFA, email security, and incident response first.
Explain the why. A 20-minute team meeting beats a 20-page PDF in an inbox.
Train with real examples. Show a real phishing email. Run a practice wire transfer request. Our phishing prevention training does this.
Get acknowledgments. Have everyone sign or click to confirm they've read the policies, including the owner.
Add them to onboarding. New hires read and sign them in their first week.
Review yearly. Change what didn't work.
How Often Should IT Policies Be Reviewed?
At least once a year, and whenever something big changes: a new system, a new law, a merger, or a security incident.
NIST's Cybersecurity Framework 2.0 says the same thing in more formal language. Category GV.PO-02 calls for cybersecurity policy that "is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission." (You can read the whole NIST CSF 2.0 document here.) Put the review date on each policy, and put a reminder on someone's calendar.
When You Don't Need Us for This
You can write your own IT policies and procedures. Seriously. Grab a template, trim it down to what applies to your business, and have your team sign it.
If you're under ten people with no regulated data, the ten policies above on two pages each will cover you well. Where outside help pays off: you're facing HIPAA, CMMC, the FTC Safeguards Rule, or a SOC 2 audit, a client sent a 200-question security questionnaire, or you need the policies enforced in Microsoft 365 and Intune as well as written down. A virtual CISO can own that work for you.
Straight Answers About IT Policies and Procedures
What are IT policies and procedures?
IT policies are written rules for how a company uses technology and protects data. Procedures are the step-by-step instructions people follow to meet those rules.
What IT policies should a company have?
At minimum: acceptable use, information security, password and MFA, email security, data handling, remote work and BYOD, backup and recovery, incident response, patching and lifecycle, and access control with offboarding.
What is the difference between a policy and a procedure?
A policy states what must happen and why. A procedure explains exactly how to do it, step by step. "All accounts use MFA" is a policy. The setup instructions are the procedure.
How often should IT policies be reviewed?
At least once a year, and any time you add a major system, face a new regulation, or have a security incident.
Who is responsible for IT policies?
Leadership approves them and owns the risk. IT or your managed service provider usually writes and enforces them, and every employee is responsible for following them.
Are IT policies legally required?
For some businesses, yes. Regulated industries like healthcare, finance, and defense contracting must have written security policies. Even when it's not required by law, insurers and clients often require them.
Still Stuck? Give Us a Call
If your IT policies and procedures currently live in one person's head, give us a call at 410-703-3857 or send us a note. We write, roll out, and enforce IT policies for businesses across Maryland, Virginia, and DC, including Columbia and Alexandria, as part of our managed IT services at one flat monthly rate.
Step one is still "restart it." We just wrote it down for you.
Comments