Browse tools

IT Policy Generator

Practical, plain-English IT and cyber security policies for small and medium UK businesses. Fill in a few details, choose your rules, and download policies ready to review, sign off and share with your team. Aligned with NCSC guidance and Cyber Essentials.

Your organisation

Policies and options

Tick the policies you want. Open each one to set your rules.

Options
Options
Options
Options
Options
Options
Options
Options
Options
Options
Options

Your answers are saved in this browser only.

How to use these policies

  • Read every policy and change anything that doesn't match how you really work. A policy nobody follows is worse than none.
  • Have it checked by whoever advises you on HR and employment law, especially the parts about monitoring and disciplinary action.
  • Share it with everyone it applies to, explain why it matters, and ask them to tick and sign the staff acknowledgement page at the end. Keep the signed copies.
  • Review it on the date shown, and whenever something big changes, like a new system or an incident.

Cyber Essentials and NCSC

  • The rules follow the Cyber Essentials requirements (v3.3, the Danzell question set): multi-factor authentication on every cloud service, critical updates within 14 days, separate admin accounts, locked devices and prompt removal of leavers.
  • Password advice follows the NCSC: long passwords such as three random words, a password manager, and no forced regular changes.
  • Check your answers with our Cyber Essentials Checker, and keep our Cyber Incident First-Hour Guide handy.

Opening the downloads

  • Download for Word saves a .doc file that Microsoft Word, LibreOffice and Google Docs can open and edit. Word may ask you to save it as .docx after editing.
  • Download HTML saves a single web page you can open in any browser, put on your intranet or print to PDF.
  • Everything is made in your browser. Nothing you type is sent to our server.

Important

  • These are starting templates, not legal advice. You're responsible for checking they suit your organisation and comply with the law, including UK GDPR and employment law.
  • Policies are only part of the job: the technical settings they describe (MFA, updates, backups) need to be switched on and checked too.

More free tools