Every blank you fill appears in the document as you type. Click a highlighted blank to jump to its field.
Fill in the blanks
0 of 5
The preview updates as you type.
Company Cyber Security Policy
Company Cyber Security Policy
Company Name
Effective Date
Policy Owner
Approved By
Chief Information Security Officer
1. Purpose & Scope
(a)This policy establishes the Organization's cyber security framework to protect information assets, systems, and networks from cyber threats including unauthorised access, data breaches, malware, and social engineering attacks.
(b)This policy applies to all information systems, networks, applications, and data owned or operated by the Organization, as well as all individuals who access these resources, including employees, contractors, and third-party service providers.
(c)The Chief Information Security Officer shall provide executive leadership for the Organization's cyber security program and shall be accountable for the development, implementation, and continuous improvement of the cyber security strategy.
2. Threat Protection & Network Security
(a)The Organization shall deploy a defence-in-depth security architecture that includes firewalls, intrusion detection and prevention systems, endpoint protection, and network segmentation to protect against external and internal cyber threats.
(b)All Organization systems and applications shall be subject to a formal vulnerability management program that includes regular scanning, risk-based prioritisation, and timely remediation of identified vulnerabilities.
(c)The Organization shall implement security information and event management capabilities to provide real-time monitoring, correlation, and analysis of security events across all critical systems and networks.
(d)All software, firmware, and operating systems shall be maintained at supported versions and patched in accordance with the Organization's patch management schedule. End-of-life software shall be replaced or isolated before vendor support ceases.
3. Incident Response & Recovery
(a)The Organization shall maintain a documented Cyber Security Incident Response Plan that defines the procedures for identifying, containing, eradicating, and recovering from cyber security incidents. The plan shall be tested at least annually.
(b)All employees shall report suspected cyber security incidents to the Information Security team immediately upon discovery. The Organization shall classify incidents by severity and escalate them according to defined response procedures.
(c)The Organization shall maintain business continuity and disaster recovery plans for all critical IT systems that define recovery time objectives and recovery point objectives. These plans shall be tested at least annually.
4. Security Awareness & Training
(a)All employees shall complete mandatory cyber security awareness training upon hire and annually thereafter. Training shall cover phishing recognition, password security, social engineering, data handling, and incident reporting procedures.
(b)The Organization shall conduct simulated phishing exercises at least quarterly to test employee resilience against social engineering attacks. Results shall be tracked and employees who repeatedly fail shall receive additional targeted training.
(c)IT administrators and security personnel shall receive specialised technical training on an ongoing basis, covering current threat landscapes, advanced security technologies, and incident response techniques relevant to their roles.
5. Compliance & Policy Review
(a)The Organization shall conduct formal cyber security risk assessments at least annually, using a methodology aligned with the NIST Cybersecurity Framework, to identify, evaluate, and prioritise cyber risks across the Organization.
(b)The Organization shall engage an independent third-party auditor to assess the effectiveness of its cyber security controls at least annually. Audit scope shall include penetration testing, policy compliance, and control effectiveness.
(c)This policy shall be reviewed at least annually by the CISO in consultation with the Cyber Security Steering Committee. The policy shall be updated to reflect changes in the threat landscape, technology environment, and regulatory requirements.
The guide
Everything you need to know about the company cyber security policy
What Is a Company Cyber Security Policy?
A company cyber security policy is a written document that sets the rules and expectations for how employees protect company systems, networks, and data from digital threats. It covers everything from safe email habits and device use to how staff should report a suspected breach. Rather than living in the IT team's head, the policy gives every employee a clear, shared standard for keeping information secure.
Why Companies Need a Cyber Security Policy
Most breaches start with human error, so technology alone will not keep you safe. A written policy turns vague good intentions into specific behavior: locking screens, spotting phishing, avoiding unapproved software. It also protects the business legally, supports compliance with frameworks like ISO 27001 or SOC 2, and gives you a consistent basis for training, audits, and disciplinary action when rules are ignored.
What a Cyber Security Policy Should Include
Cover the essentials: acceptable use of devices and networks, password and multi-factor authentication rules, email and phishing guidance, safe handling of sensitive data, and remote or public Wi-Fi expectations. Add a clear incident reporting process so staff know who to contact and how fast. Finish with roles and responsibilities, consequences for violations, and a review date so the policy stays current as threats evolve.
Review the policy at least once a year, and sooner if you adopt new tools, face a security incident, or hit a compliance deadline. Threats and technology change quickly, so an annual cadence keeps the rules relevant. Log each review date so auditors can see the policy is actively maintained.
Enforcement is usually shared between IT or security leadership and HR. IT sets the technical controls and monitors compliance, while HR handles training, acknowledgements, and any disciplinary follow-up. Every employee still holds day-to-day responsibility for following the rules.
Yes, having employees acknowledge the policy in writing or electronically creates a clear record that they received and understood it. This matters for compliance audits and for any future disciplinary action. Collect a fresh acknowledgement whenever the policy is materially updated.
Ready to get started?
Create an account and send your first screening link today. The free plan gives you 10 credits a month, with no card needed.
