Information Security Policy for Small Business

An information security policy is a written statement of how the company protects its information, so that everyone works to the same rules. It is often thought of as something only large companies need, but customers now ask even very small firms, "Do you have a security policy?" You do not need an IT specialist: with the free templates published by IPA (Japan's Information-technology Promotion Agency), a first version can be written in a few days to a few weeks. This article explains the three-layer structure of a policy (basic policy, standards and procedures), why you need one, how to use the IPA guidelines and appendices, the minimum items to decide, six steps to write it, rough costs for do-it-yourself, expert support and consulting, and how to keep it from becoming a dead document. The costs are "typical market ranges" only; actual amounts depend on company size and the provider.

A policy is generally considered in three layers. You do not have to put everything in one document; a small company varies the volume per layer and builds up in stages.

For example, "do not reuse passwords" is a layer-2 standard, while "which tool, who manages it and how" is a layer-3 procedure. Having layer 1 makes decisions in layers 2 and 3 more consistent. IPA's guidelines also assume that management states the basic policy and that it is then turned into concrete rules and procedures.

"We are too small to be targeted" is hard to sustain in 2026. There are four main reasons.

First, customer security questionnaires. Dealings with large companies and public bodies can require written answers about your security management. Typical questions are "Do you have an information security policy?", "Do you train employees?" and "Do you have an incident contact structure?" Having the documents changes how convincing your answers are. Companies that cannot meet a customer's requirement can be disadvantaged at account opening or contract renewal.

Second, certifications such as the Privacy Mark (P Mark) and ISMS. These assume that policies and rules are in place. Whether or not you go on to certification, writing the policy first lightens the later load. Costs and decision points are in the P Mark and ISMS cost guide.

Third, applying for or renewing cyber insurance. Some insurers ask you to answer a questionnaire on your security measures when you apply. Questions may cover MFA, backups and employee training, and it is easier to answer if you operate according to a policy. Conditions differ by insurer and product, so check individually.

Fourth, generative AI. Employees pasting customer data or internal documents into generative AI cannot be prevented by a ban alone; you need written guidance on what may and may not be entered. The thinking is covered in how to write company rules for generative AI. A single generative-AI item in the policy gives you a base to add detailed rules later.

The overall risk map for the company is in the IT risk guide for small businesses. The policy covers the "people and rules" part of it.

You do not need to write from a blank page. IPA's "Information Security Guidelines for Small and Medium-sized Enterprises" come with templates you can use as appendices. Based on IPA's official page as of November 2026, they are as follows.

The guidelines themselves have two parts: a management part setting out what executives should recognise, and a practice part with procedures for implementing measures in the company. On version, IPA's page says version 4.0 was published on 27 March 2026. In that revision backup was added to the earlier five rules, making them the "six rules of information security." Templates may be updated, so check IPA's official page for the latest version before use.

One caution: the sample rules in Appendix 5 will not fit your actual situation if submitted as they are. The sample contains clauses that assume departments, equipment and tools you may not have. Adopting rules you cannot follow leads to a dead document. Use the sample as a checklist to avoid gaps, then cut and rewrite to match your reality.

SECURITY ACTION is a scheme run by IPA in which small businesses declare that they are working on security. It can be used as supporting material for customers, and may relate to application requirements for some subsidies (requirements change by year and scheme, so check the call for applications). What IPA's official pages say about the declarations is as follows.

The six rules are: keep the OS and software up to date, install antivirus software, strengthen passwords, review sharing settings, take backups, and learn about threats and attack methods. Two stars require publishing the basic policy externally, for example on your website or company brochure. The application method is said to have moved to a new management system in April 2026, so check IPA's official page for the current procedure.

A natural order is to declare one star and work on the six rules, understand the current state through the self-assessment, then write the basic policy and declare two stars. The basic policy is only one page, so it gives an early sense of achievement.

Before writing dozens of pages of rules, decide the following eight items first. They alone handle most everyday incidents.

Adding "who," "by when" and "how it is checked" to each row makes this start to work as a policy. "Strengthen passwords" alone is less likely to be done than "MFA is required on key cloud services, and the administrative staff check the settings once a quarter."

Answer IPA's five-minute self-assessment and find the missing measures. At the same time, list in the asset register (Appendix 6) the PCs, smartphones, cloud services and where important data is kept. You cannot write rules without seeing what you are protecting. This often takes half a day to a day.

Make the executive the top person responsible and appoint one person for daily operation. In companies without IT staff, someone in general affairs or accounting often does this as a side duty. Decide the scope here too: regular employees only, or also part-timers, contractors and agency staff. If subcontractors or outside collaborators touch the information, include them.

Use the Appendix 2 sample and include the company name, purpose, what is protected, the responsible person, legal compliance and ongoing review. Keep it to one page. One or two lines in the owner's own words about why you protect information helps it reach employees. Completing it also satisfies the basic-policy requirement for the two-star declaration.

From the eight items above, write what you need, using Appendix 5 as reference. You do not need to write everything at first. After writing, always check with the person in charge: "Can the company really keep this today?" Delete or reshape items you cannot keep.

Turn the exit procedure, how to take backups and the incident contact chain into manuals and checklists. IPA's Appendix 8 (guide to responding to security incidents) is a useful reference. Include people who can be reached at night and on holidays. The thinking for actual first response is also in first response to a data breach.

A policy that is only written has no effect. Explain it to everyone and keep a record that they read it. The handbook (Appendix 4) lets you present it with slides. Then publish the basic policy on your website or similar and declare SECURITY ACTION two stars. For training costs and methods, see the security awareness training cost guide.

Cost varies greatly with who writes how much. The amounts below are typical market ranges and vary with provider, size and scope. Before deciding, ask several firms for quotes on the same conditions and compare.

Factors that move the price are headcount, number of sites, how sensitive the information is (such as the volume of personal data), existing documents and how deep the review is. When commissioning, confirm in the quote the deliverables (which documents, how many pages), the number of meetings, extra cost for revisions and whether questions after delivery are answered. Note that writing documents does not itself improve security; the cost of implementing measures such as device encryption and backups is separate.

A practical rule of thumb: write it yourself first (method 1), consider method 2 when a customer sends a questionnaire, and keep methods 3 and 4 for when a customer demands certification or detailed documentation.

The most common failure of policies is being left alone after being written. Put the following into the annual calendar.

In a review, find the clauses that were not followed and reshape them into something that can be followed. Leaving unfollowed rules in place causes the whole policy to be treated lightly. A culture in which near misses (events that did not result in actual harm) can be reported without blame also affects how well the policy works. In a company where the reporter is scolded, incidents are hidden and grow.

- Submitting the template as it was: clauses about departments and tools you do not have remain, and the rules cannot be kept. Use the sample to check for gaps and cut it to fit reality
- Stopping while aiming for a perfect rulebook: months pass aiming for dozens of pages. First write a one-page basic policy and a simple version of the eight items, then add
- Only the person in charge knows: management and staff do not know the content and cannot act at the moment of an incident. Always inform and train
- Written and forgotten: no annual review, so the policy stays old after tools and working styles change
- No executive involvement: cost and priorities are not decided and measures stall. Issue the basic policy in the executive's name
- No incident chain, or an outdated one: a leaver is still listed, or nobody can be reached on a holiday, so it cannot be used when needed
- Exceptions multiply: allowing exceptions for being busy or for the boss turns the rules into a formality

- Have you completed IPA's five-minute information security self-assessment?
- Have you listed PCs, smartphones and cloud services in use?
- Have you named the executive as top person responsible and appointed a daily operator?
- Have you decided the scope (employees, part-timers, contractors and so on)?
- Have you put the basic policy on one page and had the executive approve it?
- Have you set rules for passwords and MFA?
- Have you set rules for taking devices out and reporting a loss?
- Have you set rules for email attachments and misdirected mail?
- Have you decided which cloud services are allowed and who administers them?
- Have you decided backup scope, frequency, location and restore checks?
- Have you written joining and leaving procedures (granting access, disabling accounts, collecting devices)?
- Have you made an incident contact chain and outside advisers, and confirmed a holiday contact route?
- Have you decided what may and may not be entered into generative AI?
- Have you explained it to everyone and kept a record that they read it?
- Have you put the annual review date in the yearly calendar?
- Have you considered declaring SECURITY ACTION?