What IT Policies Does Every Business Need? The Core Set, Explained

The short answer

Every business needs a core set of eight to ten IT policies: information security, acceptable use (including AI), access control, data and privacy, backup and recovery, incident response, devices and remote work, and supplier management. Each should be short, written in plain English, owned by a named person and matched to controls that actually exist. A tight, accurate policy set protects the business far better than a thick binder nobody reads.

Why do IT policies matter?

Policies do three jobs. They tell staff what is expected. They set the minimum standards your IT team or managed service provider must deliver. And they give evidence to insurers, customers, auditors and regulators that you take security and data seriously.

Cyber insurance questionnaires, enterprise customer due diligence and privacy obligations increasingly ask what policies you have and whether they are followed. Under the Privacy Act, APP entities must take reasonable steps to protect personal information. Documented policies, backed by working controls, help show those steps were taken. (This is general information, not legal advice.)

What are the core IT policies?

Smaller businesses can combine some of these. The device policy can sit inside acceptable use, and change management can be a page within the security policy.

What should each policy include?

Information security policy. The anchor document. State the business's commitment, who is accountable, and the minimum technical controls, such as MFA, patching timeframes, encryption, logging and endpoint protection. Many Australian organisations align these controls to the ASD's Essential Eight.

Acceptable use policy. Set out what staff may and may not do with company technology. In practice, cover personal use, prohibited content, monitoring and the consequences of breaches. It now needs a clear section on generative AI: which tools are approved and what data must never be entered.

Access control policy. Define how accounts are requested, approved, changed and removed. Include privileged and admin accounts, shared accounts and regular access reviews. Offboarding is where many incidents start.

Data and privacy policy. Classify data (for example, public, internal, confidential and personal), set handling rules for each class, define retention and disposal, and connect to your privacy policy and obligations under the Australian Privacy Principles.

Backup and recovery policy. Specify what is backed up, how often, where copies are stored (including offline or immutable copies), how long they are kept and how often restores are tested. Set recovery time and recovery point targets for critical systems.

Incident response plan. A practical playbook, not a policy statement: who leads, who to call, how to contain an incident, and how to assess notification duties such as the Notifiable Data Breaches scheme and, for larger businesses, ransomware payment reporting. Include contact details and keep a printed copy.

Device and remote work policy. Cover company-issued and personal devices, encryption, screen locks, lost device reporting, home network expectations and public Wi-Fi.

Supplier and cloud policy. Set a proportionate due diligence process for new vendors based on the data and access they will have, along with contract minimums such as security obligations, breach notification and data location.

How do you write policies people actually follow?

1. Write for the reader. Staff-facing policies should be readable in five minutes. Put technical standards in a separate document for IT.
2. Use "must" and "must not". Clear obligations beat vague aspirations.
3. Match reality. If the policy says backups are tested monthly, they must be. Policies describing controls you do not have can mislead insurers and undermine you after an incident.
4. Explain the why. One sentence on the reason behind a rule improves compliance.
5. Make exceptions explicit. Define how to request an exception and who approves it.
6. Train and acknowledge. Brief new starters, refresh annually and record acknowledgement.

How should policies be maintained?

Policies are one part of a broader governance system. Our guide to a right-sized IT governance framework shows how they fit with decision rights, risk management and reporting. Policies also help bring unapproved tools under control, as covered in shadow IT governance.

What mistakes should you avoid?

• Copying a large enterprise template. Policies for 10,000 staff rarely suit 50.
• Writing once and forgetting. Outdated policies, especially those silent on AI, leave gaps.
• Leaving it all to the MSP. Providers can draft technical standards, but the business must own the rules and the risk.
• No link to consequences. A policy without enforcement is a suggestion.

Building your policy set with The Technology Office

The Technology Office develops IT policy sets that are practical, accurate and right-sized to the business. We are independent and vendor-neutral, so policies are written around your risks and obligations rather than any product. With a CIO-level and board perspective, we make sure policies connect to real controls and can be explained to directors, insurers and customers in plain English.

Through our IT governance and risk consulting and cybersecurity governance services, we review what you have, close the gaps, including AI use, and set up a simple maintenance rhythm. We work with businesses of any size and industry across Australia.