Business template
Company Policy template
An internal company policy with purpose, scope, rules, incident reporting, responsibilities, training, breaches and review. It suits any organisation writing an information security or similar staff policy.
8 sections, 5 clauses, 1 table, with a cover page
Use this template opens a copy in the document builder after you sign in. Adapt it with AI opens the generator with this template chosen, so you can describe your business and get a version written for it.
What you fill in
- [Date]
- [Your company]
- [Phone]
- [Email]
- [Privacy regulator]
The template, in full
1. Purpose
This policy sets out how [Your company] protects client and company information. It exists because we hold financial records for 2,400 clients, and a breach would harm those clients and end our licence.
2. Scope
This policy applies to every employee, contractor, volunteer and board member, on any device used for company work, including personal phones and home computers. It covers information in any form: systems, email, paper, and conversations.
3. Rules
3.1 Passwords and access. Every system uses a unique password of at least 14 characters, stored in the company password manager. Multi factor authentication is on for email, the client system, and any remote access. Never share an account, not even with your manager.
3.2 Devices. Company laptops are encrypted and locked when you step away. Personal devices used for work must have a screen lock, an up to date operating system, and the ability to be wiped remotely if lost.
3.3 Client information. Client documents live in the client system, never on a desktop, a personal drive or a USB stick. Email attachments containing client data must be sent through the secure portal, not as plain attachments.
3.4 Working away from the office. Do not discuss client matters in public. Use a privacy screen on public transport. Public wifi is fine for browsing but the company VPN must be on before you open any system.
3.5 Software. Only install software from the approved list. If you need a tool that is not on it, ask; the answer is often yes, and shadow tools are how data leaves without anyone noticing.
4. Reporting an incident
Report within one hour. A lost device, a suspicious email you clicked, or a document sent to the wrong person, all count. Call the Head of Risk on [Phone] or email [Email]. You will not be disciplined for reporting quickly and honestly.
5. Responsibilities
6. Training
Everyone completes security training within two weeks of starting, and a 30 minute refresher each year. Phishing simulations run quarterly; failing one means a short retraining session, not a disciplinary process.
7. Breaches of this policy
Deliberate breaches, such as sharing an account or moving client data to a personal drive, are treated as misconduct and may lead to dismissal. Honest mistakes reported quickly are treated as learning, and that difference is deliberate.
8. Review
The Head of Risk reviews this policy every 12 months, or sooner after a significant incident or a change in law. Version 4.0 replaces version 3.2 of [Date]. The change log is held with the policy register.