6 IT Policies Every Small Business Needs

Every business has IT policies. Most just haven't written them down. They live in the owner's head as a vague sense of "well, obviously you don't do that", and they get communicated the first time someone does exactly that.

The trouble with unwritten rules is that nobody can follow them on purpose. A new starter can't read your mind. A contractor doesn't know that the shared Dropbox was "only for that one job". And when something goes badly wrong, such as a data breach, a dismissal or a dispute over who owns a client list, "everyone knew" is a very thin thing to stand on.

The good news is you don't need a binder. You need six short documents, each one answering a question your staff will eventually ask, or should have asked. Here's what goes in each.

First, a rule about the rules

A policy nobody reads is a decoration. So before the list, one design constraint: keep each policy to roughly one or two pages, written in plain English, with the "must" items separated from the "should" items.

Do the maths on attention. If a new starter gets six policies of fifteen pages each, that's ninety pages on day one, alongside the payroll forms and the fire exits. They will scroll to the bottom and tick the box. Six two-page policies is twelve pages, which someone might actually read over a coffee. Shorter policies get followed more, and they're easier to keep up to date.

1. Acceptable use policy

This is the umbrella. It covers how company devices, accounts and internet access may be used, and it sets expectations that everything else hangs off. It should answer:

• Is reasonable personal use of work devices OK? (Usually yes, within limits. Saying so honestly beats pretending nobody checks the footy scores.)
• Can family members use a work laptop? (The answer should be no.)
• Who owns the data, the accounts and the devices? (The business, and the policy should say it plainly.)
• What's the rule for unattended devices? Lock the screen, every time.

In NSW this policy has a legal job too. Under the Workplace Surveillance Act 2005, computer surveillance of employees must be carried out in line with a policy staff have been notified about, and blocking emails or websites also requires a notified policy. If you log activity, filter web traffic or quarantine email (and almost every business with a security product does), your acceptable use policy is where that should be disclosed. We cover the detail in our guide to employee monitoring and the law. As always, this is general information rather than legal advice.

2. Password and access policy

Stolen and reused passwords are still the front door for most account takeovers, so this policy earns its place. The modern version looks different from the one many businesses wrote a decade ago:

• Length beats complexity. A passphrase of several random words is easier to remember and harder to crack than "P@ssw0rd1!".
• No forced changes every 90 days. The US standards body NIST has advised against routine password expiry for years, because it trains people to add 1 to the end. Change passwords when there's a reason to, such as a suspected compromise.
• A password manager is mandatory, and the business provides it.
• Multi-factor authentication on everything that supports it, starting with email and remote access. MFA is one of the ASD's Essential Eight mitigation strategies.
• Access follows the job. People get the access their role needs, it's reviewed when roles change, and it's removed on the last day, not "when someone gets around to it".

Getting MFA right without a staff revolt is its own skill; see MFA your staff won't try to dodge.

3. Cloud, app and AI use policy

This policy didn't exist in most businesses five years ago, and now it might be the most important one. Any staff member with a browser can sign up for a file-sharing service, a PDF converter, a transcription tool or an AI chatbot in about forty seconds, often using "Sign in with Microsoft", which quietly grants that app access to their work account.

The policy should list the approved tools for common jobs (file sharing, note-taking, AI assistance), say clearly what data must never be pasted into an unapproved service (client files, personal information, financials), and, crucially, give people a fast way to request a new tool. A request process that takes a month guarantees people will route around it. Our guide to finding unsanctioned cloud apps explains how to see what's already in use before you write this one.

4. Bring your own device and remote work policy

If anyone reads work email on their personal phone, you already have a BYOD programme. The only question is whether it has rules. This policy should cover which personal devices can access company data, the minimum security they need (a screen lock, a supported operating system, updates installed), what the business can and can't see on a personal device, and what happens to company data when someone leaves.

Fold remote work in here too: working from home, from a café, from a coworking desk. The practical guidance on working safely from cafés and coworking spaces and our BYOD guide give you most of the wording.

5. Incident response policy

This is the one people skip because it feels pessimistic. It's actually the one that saves the most money, because the first hour of a cyber incident is when the expensive mistakes get made: someone wipes the infected laptop (and the evidence), or nobody tells anyone for three days because they're embarrassed about clicking the link.

It needs to say, at minimum: what counts as an incident, who staff should call (with a phone number, not just an email address that might be compromised), that reporting a mistake will never get anyone in trouble, and who decides on the next steps. It should also note your legal clocks. If you're covered by the Privacy Act, a suspected data breach must be assessed within 30 days under the OAIC's Notifiable Data Breaches scheme, and serious breaches must be notified. Since May 2025, businesses with annual turnover over $3 million that make a ransomware or cyber extortion payment must report it to the ASD within 72 hours under the Cyber Security Act 2024.

Write it down now, while everyone's calm. Nobody writes good procedure at 2am with the server encrypted.

6. Backup and data retention policy

Two questions, one policy. First: what gets backed up, how often, where to, and when was a restore last tested? A backup that's never been restored is a hypothesis. Our article on backup that works when you need it covers the mechanics, and managed backup takes the testing off your plate.

Second: what do you keep, for how long, and when do you delete it? Australian Privacy Principle 11 requires you to destroy or de-identify personal information you no longer need, and every old record you hold is something that can leak. Tax records generally need to be kept for five years, but a scanned driver's licence from a 2019 job application probably doesn't. Our guide to building a data retention policy walks through the categories.

Making policies stick

Three habits separate living policies from dusty ones:

1. Get a signature, not just a tick. Have staff acknowledge each policy on starting and again when it changes. It matters for the surveillance notice requirements, and it matters if you ever need to rely on the policy.
2. Review once a year. Put it in the calendar. A policy that still refers to a system you retired in 2023 tells staff the whole document can be ignored.
3. Back policies with settings. If the policy says MFA is required, enforce MFA in Microsoft 365. If it says devices must be encrypted, turn on BitLocker centrally. The best policy is one people can't accidentally break.

And pair them with user awareness training, so staff understand why the rules exist. People follow rules they understand far more willingly than rules they were merely told about.

Frequently asked questions

What IT policies should a small business have?

At minimum: an acceptable use policy, a password and access policy, a cloud and AI app policy, a BYOD and remote work policy, an incident response policy, and a backup and data retention policy. Each can be one or two pages.

Do small businesses legally need IT policies?

There's no single law requiring a set of IT policies, but several laws assume you have them. In NSW, computer surveillance and email or web blocking must follow a policy notified to staff, and Privacy Act obligations are much easier to meet with documented procedures. Get legal advice for your situation.

How often should IT policies be reviewed?

Once a year, plus whenever something significant changes, such as a new system, a move to remote work, or a security incident. Ask staff to re-acknowledge any policy that changes materially.

What should an acceptable use policy include?

Rules on personal use of work devices and accounts, who may use company equipment, ownership of data and accounts, screen locking and device care, prohibited activities, and any monitoring or filtering the business carries out.

Local IT and cyber security support across NSW

Chewing IT runs managed IT and cyber security for small and mid-sized businesses from our Wyong and Hornsby offices, covering the Central Coast, Newcastle, Lake Macquarie and Hornsby.

Want IT policies that match how your business actually works? Talk to us — we'll help you write them and set up the systems that enforce them.