IT policies

Five short IT policies cover most of what a small business needs.

Policies tell staff what is expected and give you something to point to when a client, insurer or auditor asks. Here is which ones you need first, what each should say, how to keep them short and actually followed, and free starter policies you can copy and edit.

Aligned to ASD guidance and the Essential Eight. Starter templates, not legal advice. Checked 30 October 2026.

Get a full policy set Get a starter policy 07 3114 2808

The five to start with
What each covers
Free starter policies

Reviewed by Blake Bath, General Manager, on 30 October 2026.

A practice manager sits with a new staff member in the staff room as she signs a short printed policy. — **One page each**Short policies get read. Put the technical detail in a separate procedure for IT.

What we find

Why most policies do not work.

The problem is rarely that a business has no policies. It is that nobody reads, signs or follows them.

Copied from somewhere else

A 40-page template from a big company that does not match how you work.

Short
Your tools
Your words

IT policy library

Free plain-English starter policies.

Pick a policy, add your business name and owner, then copy it into your own document. Edit it to fit how you work and have staff sign it.

Pick a policy and add your business name. You get a plain-English starter policy to copy, edit and have staff sign.

Which policy?

Business namePolicy owner (name or role)

[Business name]: Acceptable use policy

6rules, one page

Company devices, accounts and internet access are for work. Limited personal use is fine if it does not affect your work, cost the business money or break the law.
Do not install software, browser extensions or apps on company devices unless IT has approved them.
Do not store company information in personal accounts, personal cloud storage or personal email.
Do not try to get around security controls, such as MFA, device management or web filtering.
Company systems may be monitored for security purposes.
Breaches of this policy may lead to disciplinary action.

Get a full policy set

Priority order

Which policies you need, and when.

Policy	When you need it	What it covers
Acceptable use	Every business	What company devices, accounts and internet are for
Passwords and MFA	Every business	Passphrases, password manager, MFA, never sharing
Devices and BYOD	Every business	Company and personal devices, lost devices, remote wipe
Incident reporting	Every business	What to report, to whom, and how fast
Joiners and leavers	Every business	Access on day one, removed on the last day
AI use	When staff use AI tools	Approved tools and what data cannot go in
Updates and patching	When a client, insurer or framework asks	Timeframes and unsupported software
Backup and recovery	10+ staff or critical data	What is backed up, how often, and restore tests
Access control	10+ staff or sensitive data	Least privilege, admin accounts, access reviews
Information security (umbrella)	For ISO 27001, SMB1001 or client questionnaires	How the business manages security overall

Making them work

What makes a policy actually work.

Short and specificPlain rules people can follow, not principles they have to interpret.
Backed by settingsEvery rule that can be enforced by a system is enforced by that system.
Signed and recordedAccepted at onboarding and again when the policy changes.
Owned and datedA named owner, a version date and a review date.
Linked to consequencesReferenced in employment agreements so breaches can be acted on.

Australian context

Where the law and frameworks come in.

Notifiable Data BreachesBusinesses covered by the Privacy Act must assess a suspected data breach and, where serious harm is likely, notify the OAIC and the people affected. Your incident policy should say how.
Essential EightSets patching timeframes and other controls. A patching policy that matches it makes assessment easier.
Client and insurer questionnairesMost ask whether you have documented policies and whether staff have accepted them.
Employment agreementsPolicies should be referenced in contracts so they can be enforced. Check with your employment adviser.

General information only, not legal advice.

Our view

Write the policy after you set the control.

We set the control first, then write the policy to match. If the policy says MFA is required, Conditional Access already requires it. If it says lost devices are wiped, Intune already can. That way the policy describes reality instead of a wish.

Then keep it short enough that staff read it in five minutes, and record who has signed. That record is what an insurer or client will ask to see.

The order

Putting IT policies in place in five steps.

Step 1Start with the five
Acceptable use, passwords, devices, incidents, joiners and leavers.
Step 2Match the settings
Make sure systems enforce what the policies say.
Step 3Get them signed
Every current staff member, then every new starter.
Step 4Add as you grow
AI, patching, backup and access control.
Step 5Review every year
And after any incident or big change.

Related guides

A policy says what to do. These guides show how.

The controls and checklists behind each policy.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about IT policies.

What IT policies should a small business have?

Start with five: acceptable use, passwords and MFA, devices and personal phones, incident reporting, and joiners and leavers. Add AI use, patching, backup and access control as you grow or when a client, insurer or framework asks for them.

How long should an IT policy be?

One or two pages. Staff need to read and understand it. A short policy people follow is worth more than a long one nobody opens. Put the technical detail in a separate standard or procedure for IT.

Do staff have to sign IT policies?

There is no law requiring a signature for most policies, but you should record that each person has read and accepted them, when they join and when a policy changes. That record matters if you need to act on a breach, or show an insurer or client what you have in place.

Should our password policy require complex passwords?

No. ASD recommends passphrases of four or more random words, where longer is better, rather than short complex passwords. Pair that with a password manager and MFA.

Do we need an AI use policy?

Yes, if staff use AI tools at work, and most do. It should say which tools are approved, what information cannot go into them, and that people are responsible for checking the output.

How often should IT policies be reviewed?

Every year, and whenever something significant changes: a new system, an incident, a new client requirement or a change in the law.

Are these templates legal advice?

No. They are plain-English starting points. Review them against your own business, your employment agreements and any industry rules, and get advice where you need it.

Next step

Want a full policy set that matches your systems?

We write policies for your business, set your Microsoft 365 to enforce them, and track who has signed.

Talk to us 07 3114 2808

Keep reading

Reviewed by Blake Bath, General Manager, on 30 October 2026. Patching timeframes from ASD's Essential Eight guidance, passphrase advice from ASD, breach notification from the OAIC. Starter templates are general information, not legal advice. Checked 30 October 2026. ASD Blueprint, Essential Eight patch applications; ASD, Essential Eight maturity model; ASD, Passphrases; OAIC, Notifiable Data Breaches scheme