An IT policy staff will actually follow is short, written in plain language, covers the handful of things that genuinely matter, like passwords, device use and what to do if something looks wrong, and gets talked through rather than just emailed out once and forgotten. A policy that’s twelve pages long, written in compliance language, and handed to someone on their first day along with every other form, isn’t a policy. It’s paperwork that happens to be about IT.
That gap matters more than it used to. The government’s Cyber Security Breaches Survey found that 52 percent of small businesses (10 to 49 employees) had a formal cyber security policy in 2025/2026, down from 59 percent the year before. That’s a declining number, not a growing one, at exactly the point where the advice around multi factor authentication and phishing awareness has never been more settled. Having a policy document isn’t the same as having one that actually changes what people do, but it’s hard to get the second without the first.
Why a policy nobody reads is worse than no policy at all
A written policy that sits unread gives a false sense of security. If something goes wrong, the business can point to the document and say the rules were there, but if nobody followed them because nobody really knew what was in it, that’s not much comfort, and it doesn’t actually prevent anything. The point of a policy isn’t to exist, it’s to change behaviour. If it isn’t doing that, it’s worth being honest that you don’t really have a policy, you have a file.
What actually makes staff follow it
Short. One page, or close to it, covers almost everything a small business genuinely needs. Plain language, written the way you’d explain it to someone in person, not the way a template from a compliance website phrases it. Specific to what you actually do, a policy copied wholesale from a generic template often includes things that don’t apply and misses things that do. And introduced properly, talked through when someone joins and referred back to occasionally, rather than filed away and never mentioned again.
A simple structure that covers what matters
| Section | What it should cover |
|---|---|
| Passwords and logins | Password managers, multi factor authentication, no sharing logins |
| Devices | Personal devices used for work, what’s allowed, what isn’t, lock screens |
| Email and phishing | How to spot a suspicious email, who to tell, never acting under pressure |
| Data and access | Who can see what, access matching the role rather than being copied from someone else |
| Remote and hybrid working | Secure connections, keeping work and home devices separate where it matters |
| Reporting a problem | Exactly who to contact and how, with no “I didn’t want to make a fuss” gap |
That’s roughly what a one page policy needs to cover. If you want the longer, more thorough version to draw from, the NCSC’s small organisations guide to cyber security is the proper reference point, free and UK specific, rather than a generic template site. Anything beyond this is probably worth a second document for specific regulatory requirements, rather than bulking out the one staff are actually meant to read day to day.
The mistakes that make a policy pointless
Writing it once and never touching it again is the most common one. Threats change, software changes, and a policy written three years ago about a version of Microsoft 365 the business has since moved on from isn’t doing much good. Copying a template without editing it is another, a policy that references systems or roles that don’t exist in your business reads as generic the moment someone actually looks at it, and generic is exactly what gets ignored. And having no one responsible for actually enforcing or updating it means it drifts out of date quietly, nobody decides to abandon it, it just happens.
Frequently asked questions
How long should an IT policy actually be?
Short enough that someone will genuinely read the whole thing, usually a page or two for a small business. If it’s longer than that, it’s worth asking what’s in there that isn’t actually necessary.
Does every business legally need a written IT policy?
There’s no single blanket legal requirement for every business, but if you handle any personal data, which almost all businesses do, having clear data handling practices is expected under GDPR. The ICO’s getting started with data protection guide is a reasonable starting point if you want to check what’s actually expected, and a written policy is the easiest way to demonstrate you’ve thought about it properly.
How often should it be reviewed?
At least once a year, and whenever something changes meaningfully, a new system, a new way of working, or a new type of threat becoming common. A policy that’s never been touched since it was written is usually a sign it’s been forgotten rather than that nothing’s changed.
If your current IT policy is a document nobody’s looked at since it was written, or there isn’t one at all, that’s a fairly quick thing to put right properly rather than something that needs to stay on the to do list. 127 Solutions supports growing businesses across Cheshire, Wirral, Chester and Liverpool with exactly this kind of practical IT groundwork, and we’re happy to help put something together that actually gets used. Get in touch.