On this page

A cyber security policy describes:

  • how you protect your accounts, devices and information
  • rules staff must follow to maintain cyber security
  • what to do if a cyber incident occurs.

Consider including the following in your cyber security policy.

1. Securing accounts

Explain your rules for creating secure logins for accounts and devices.

For example:

  • whether passkeys are needed
  • requirements for strong, unique passwords
  • use of multi-factor authentication (MFA) and any devices or apps needed
  • rules around storing passwords and using password managers
  • how often you need to update passwords
  • when and how you change login details after staff leave.

2. Access controls

Your cyber security policy should outline the different access levels for roles in your business. Staff should generally only have access to the accounts and systems they need to do their jobs.

Also explain:

  • how you monitor access to your systems to identify any unusual behaviour
  • when you review access permissions, such as when a staff member changes roles.

3. Email security

Cyber criminals use email to try and steal account details, install malware and run scams.

Your policy should include guidelines on:

  • where it’s appropriate for staff to share their work email address
  • how your business blocks spam
  • only opening email attachments from trusted contacts and businesses
  • how to identify, delete and report suspicious emails.

4. Handling data

Your policy should outline:

  • where and how you store business data
  • rules for handling sensitive data, including customer information
  • your backup processes
  • when and how staff can share data with other systems, people or businesses
  • how to destroy sensitive data when it is no longer needed.

5. Protecting devices

Rules around computers, phones and other devices should cover:

  • where employees can use work devices
  • when screens and devices must be locked
  • security controls to unlock a device. For example, password, fingerprint or facial recognition
  • how to securely store devices when not in use
  • when and how system updates are rolled out to employee devices
  • restrictions on plugging in USB sticks and other removable devices (to prevent malware being installed)
  • how to report a lost or stolen work device
  • wiping old devices before disposing of them.

6. Remote work

Working remotely can have additional security risks. If you or your staff work remotely, consider including:

  • rules around what staff can access in a public place
  • precautions when using public wi-fi
  • approved ways to transfer files between work and home
  • permitted online meeting tools and how to prevent unauthorised access.

7. Social media and web use

Your guidelines around social media and internet access could cover:

  • rules for using your business social media channels
  • what business-related information staff can share on their personal social media
  • appropriate personal web and social media use during work hours.

8. Incident response plan

An incident response plan outlines the steps you and your staff will follow when a cyber security incident occurs. It can help minimise the impact of the incident and get you back to business as soon as possible.

To create an incident response plan:

  • Identify the most common cyber security threats your business might face.
  • Create step-by-step procedures outlining how you’ll detect, contain, respond to and recover from these threats. The cyber.gov.au website has information on recovering from cyber incidents you can use to get started.
  • Clearly define staff roles and responsibilities during an incident.
  • If you can, test the plan with a simulated incident to identify gaps and improvements.

Keep your policy up to date

Review and update your cyber security policy regularly or in response to:

  • new threats
  • cyber incidents or near misses
  • changes to your systems or business. 

Read next