Information Security Policy Template for Small Business

The insurance questionnaire asks: "Do you have a written information security policy approved by senior management?" At a 30-person distributor in Laval, the controller hesitates. There is a document from 2019, written by a former technician, that still mentions Windows 7. Nobody has opened it since.

That's the most common situation in small businesses: either there's nothing at all, or there's a generic 40-page document nobody follows. Both are a problem. A useful security policy is short, fits the business and is actually applied.

Below is a 12-section template you can adapt, what privacy law changes about who signs off, and the mistakes to avoid.

Policy, standard, procedure: three levels

The first trap is cramming everything into one document. A three-level structure stays simple and ages much better.

In its baseline controls for small and medium organizations, the Canadian Centre for Cyber Security recommends, among other things, making a specific member of leadership responsible for IT security and setting clear rules on passwords. Those are two textbook policy commitments. NIST's Cybersecurity Framework 2.0 also places cybersecurity policy in its "Govern" function: the policy must be established, communicated, enforced and reviewed. Our explainer on NIST CSF 2.0 for small business covers the rest of the framework.

The template: a 12-section outline

Here's the outline our team uses as a starting point. Adapt each section and delete what doesn't apply.

1. Purpose and scope. Why the policy exists, who it covers (employees, interns, contractors, your IT provider) and which assets: computers, phones, cloud accounts, paper.
2. Roles and responsibilities. Leadership, information security lead, privacy officer, managers, employees, IT provider. One name or title per role.
3. Information classification. Three levels are often enough: public, internal, confidential. Give concrete examples for each (client files, payroll, bids).
4. Acceptable use. Company devices, reasonable personal use, approved software, generative AI tools, personal devices.
5. Access management. Least privilege, named accounts, MFA, separate admin accounts, access reviews, joiners and leavers.
6. Passwords and authentication. Minimum length, password manager, no reuse.
7. Device protection. Encryption, antivirus or EDR, automatic screen lock, updates.
8. Patch and vulnerability management. Deadlines by severity, with a pointer to the detailed standard.
9. Backups and continuity. Frequency, offline copy, restore testing.
10. Vendors and cloud services. Contract requirements, third-party access, data location.
11. Incident management. How to report, who decides, links to the response plan and the incident register.
12. Awareness, compliance and review. Training at hiring and yearly, consequences of non-compliance, review date, version history and signatures.

For sections 8 and 11, you can build on our templates for a patch management policy and an incident response plan.

What privacy law adds

Quebec's private-sector privacy act doesn't require a document titled "security policy." It does, however, set several obligations that connect directly to one.

• Section 3.2: every business must establish and implement governance policies and practices for personal information that ensure its protection. They must cover, among other things, retention and destruction, the roles and responsibilities of staff throughout the information's life cycle, and a complaints process. They must be proportionate to the nature and scope of the business's activities and approved by the person in charge of the protection of personal information. Detailed information about them must be published, in clear and simple terms, on the company's website.
• Section 10: security measures must be reasonable given, among other things, the sensitivity of the information, the purpose of its use, its quantity, its distribution and the medium it's stored on.
• Section 20: an employee may access personal information only if it's needed to perform their duties. That's least privilege, written into law.

In practice, you have two options. Either the security policy includes the personal information component and is approved by both leadership and the privacy officer, or the two documents stay separate and cross-reference each other. By default, the person with the highest authority in the business acts as privacy officer (section 3.1), which often simplifies sign-off in a small company. Our article on the privacy officer's security role goes further. Check your approach with legal counsel.

Outside Quebec, PIPEDA's accountability principle points the same way: the federal privacy commissioner expects businesses to develop, document and implement policies and procedures to protect personal information, and to be ready to show them.

The most common mistakes

• Promising what you don't do. "All data is encrypted," while the NAS isn't. During an insurance claim or an investigation, the gap between paper and reality gets expensive.
• Copying a template without adapting it. Free templates, like the SANS library, are a good starting point, but they're written with large organizations in mind.
• Forgetting the IT provider. They often hold the most powerful access. The policy applies to them too.
• Never presenting it to staff. A policy nobody has read doesn't exist. A 30-minute session and a signature at hiring go a long way.
• Letting it go stale. Set a review date and name an owner.

Rolling out the policy in 30 days

• Week 1: name the policy owner and inventory what already exists.
• Week 2: draft the 12 sections describing actual practice, with target dates for any gaps.
• Week 3: get it reviewed by leadership, the privacy officer and the IT provider.
• Week 4: approve, sign, present to staff and collect read acknowledgements.
• Ongoing: attach standards and procedures, then schedule the annual review.

If you'd like an outside look at how your policy compares with your real practices and legal obligations, our Law 25 compliance service includes a review of governance and security policies.