If your cyber insurer asked this morning whether you had a documented incident response plan, or a new client sent over a procurement questionnaire that required your acceptable use policy, the answer might have been nothing. That is the most common position for UK small businesses in 2026.

Having a working IT policy checklist is not about collecting templates. It is about having a small set of current, clearly named policies that answer the questions insurers, auditors, and clients now require. The list of expected policies has grown since 2024 because Cyber Essentials v3.3, insurance underwriting changes, and the Cyber Security and Resilience Bill have all pushed new items into the bar.

This article is a practical checklist for 10-to-25-seat businesses that want to know which policies they need, why they are asked for, and the most sensible order to write them.

What Does "IT Policy" Actually Mean for a Small Business?

An IT policy is a short, named document that says what your business expects around a specific area of technology use. It is not a technical specification. It is a statement of rules that staff can understand and that someone outside the business can inspect.

Most SMEs confuse IT policies with IT configurations. Configurations are the technical settings applied to devices and accounts. Policies are the written decisions that say which configurations exist and why. An auditor cannot test your settings without seeing the policy that governs them.

The distinction matters because many SMEs have done some configuration work — they have encryption on devices, multi-factor authentication in place — but have no written policy that says those things are required. When a client or insurer asks for evidence, the settings are invisible without the governing document.

The IT Policy Checklist: 12 Policies UK SMEs Need in 2026

The following policies represent the minimum set that a competent auditor, insurer, or procurement team will expect to see from a UK SME in 2026. Each is described in plain terms with the area it covers and the parties most likely to ask for it.

1. Acceptable Use Policy

Defines what staff can and cannot do with company devices, accounts, and data. This is the broadest single policy — it touches every employee and sets the tone for the rest of the programme. Auditors and HR teams ask for it.

2. Password and Authentication Policy

States the requirements for password length, rotation, multi-factor authentication, and password manager use. This is one of the Cyber Essentials technical controls. Assessors ask for it.

3. Joiner-Mover-Leaver Policy

Describes how accounts are created when someone starts, how permissions change when someone moves roles, and how access is removed when someone leaves. Departing staff with active access remain the highest-risk operational gap for small businesses. Auditors and procurement teams ask for this.

4. BYOD (Bring Your Own Device) Policy

Covers personal devices accessing work data — app protection requirements, what happens at leaver stage, and whether the business will enforce any wipe capability. Cyber Essentials and insurers now ask about this.

5. Remote and Hybrid Work Policy

States expectations around home working setup, secure Wi-Fi, and conditional access requirements. This became standard after 2020, but insurers are now asking specifically for written remote working security expectations.

6. Incident Response Plan

Defines who notifies who, in what timeframe, and with what evidence when a security incident occurs. Insurers require this. Regulated clients expect it. The UK Cyber Security Breaches Survey 2025/26 reports that 43% of UK businesses experienced a cyber breach or attack in the last year — having a written plan is not theoretical.

7. Data Protection (GDPR) Policy

Covers lawful basis for processing, data retention schedules, subject access requests, and breach reporting procedures. The ICO sets the requirements. Clients and regulators ask for this.

8. Backup and Recovery Policy

States what data is backed up, how often backups are tested, and who is authorised to perform a restore. Insurers and auditors are increasingly specific about testing, not just configuration.

9. Patch Management Policy

Sets the cadence for applying security updates, how exceptions are handled, and how end-of-life systems are tracked. Cyber Essentials assessors look for evidence of this policy and its implementation.

10. Third-Party and Supplier Policy

Describes what the business asks of its own suppliers, how often supplier security is reviewed, and what happens when a regulated client cascades requirements downstream. The Cyber Security and Resilience Bill is pushing supplier assurance downstream. Procurement teams now ask for this.

11. AI Use Policy

States who can use which AI tools, on what data, and with what guardrails. Most SMEs have adopted Copilot or similar tools without writing the policy that governs their use. This is the fastest-growing procurement question in 2026.

12. Asset Management Policy

Covers the inventory of devices, software, and accounts, including named owners for each asset. Without this, the leaver process becomes a guessing exercise. Auditors and insurance teams ask for this.

How to Use This Checklist

The most common mistake SMEs make is treating this as a twelve-document project to complete in one sitting. That approach produces poor results because the policies are written in isolation from how the business actually operates.

A more practical approach is to write only what is needed first, then add the rest as external requests surface.

The recommended starting sequence for a business that currently has none:

Step 1. Acceptable use policy. Touches every employee, simplest to draft, sets the tone for the rest.

Step 2. Joiner-mover-leaver process. Closes the highest-risk operational gap immediately.

Step 3. Incident response plan. Required by most insurers, asked by regulated clients.

Step 4. AI use policy. The fastest-growing procurement question.

Everything else can be added in the order auditors, insurers, or clients raise it. Most SMEs do not need to write all twelve policies before they are asked.

Two to four working sessions of two hours, with the business owner and the IT supplier present, will produce drafts of the first four. Drafts beat downloaded templates because the policy reflects how the business actually operates.

When to Review Your Policies

Annually, with a quarterly check-in for anything that changed during the year. The review should take thirty minutes per policy if the policy is short and current — which it should be. No one needs a fifty-page document that nobody reads.

Most SMEs schedule reviews against their cyber insurance renewal date. That is sensible, because that is when the policies get asked about anyway.

Why Policies Matter Beyond Compliance

Policies are often treated as a compliance exercise — something to collect before an audit. The real business value is wider than that.

Insurance claims. Insurers will not pay claims cleanly if there is no documented incident response plan or acceptable use policy in place at the time of the event. Loss adjusters asking "was the policy in place?" can decide whether a claim is paid in full, paid in part, or refused.

Procurement outcomes. Missing more than three policies on this list means a business will struggle with serious procurement questionnaires. Clients do not want to hear that the business "had not got round to that."

Operational clarity. When policies are written, staff know what is expected. Support teams spend less time explaining individual decisions and more time resolving genuine issues.

Defensible operations. A standardised set of policies makes security easier to maintain. If a vulnerability is discovered, applying a patch across known configurations takes a fraction of the time required when device configurations differ from user to user.

The NCSC's guidance for small organisations consistently recommends documented policies as a foundational practice. Policies do not replace technical controls — they make the controls visible and maintainable.

How Standardisation Makes Policies Work

Writing policies is only the beginning. The next stage is making sure the policies you have written are actually reflected in how the business operates day to day.

This is where standardisation comes in. If you have an acceptable use policy but devices are configured differently from one user to the next, the policy is aspirational. If you have a patch management policy but some devices are six months behind on updates, the policy is a fiction.

A standardised IT baseline — a single agreed configuration that every device follows — is the mechanism that turns written policy into actual practice. When devices arrive configured to the same standard, when user access follows the same process on every joiner, mover, and leaver event, the policies you have written start to match what auditors actually see when they look at your systems.

Standardisation is what makes policies defensible rather than decorative.

Where to Start: A Practical Assessment

Before writing additional policies, it helps to understand what you already have. Many businesses that feel they have "no policies" actually have some controls in place — encryption on devices, password requirements, MFA enabled — but without written documentation, those controls are invisible to external reviewers.

A Security Triage Call is the recommended starting point. It provides an independent baseline review of your current IT setup against a recognised security standard, identifies the gaps between what you have configured and what external parties require, and gives you a ranked list of priorities. You get clarity on what exists and what needs to be written before the next audit, insurer review, or procurement questionnaire.

If you currently have fewer than three policies on the checklist above, or if you are unsure whether what you have written would satisfy an external auditor, booking a review is the practical first step. It takes the guesswork out of prioritisation and gives you a clear plan rather than a patchwork of half-finished documents.

Frequently Asked Questions

Do UK SMEs legally have to write IT policies?

There is no single law that says "every SME must write an IT policy." However, several regulatory and contractual frameworks effectively require one. The UK GDPR expects documented security measures. Cyber Essentials requires evidence of security policies including a password policy and an information security policy. Most cyber insurance policies now require documented security procedures as a condition of cover. Procurement questionnaires from government and regulated clients increasingly require written policies as a baseline expectation.

How many policies does a small business really need?

The minimum practical set is four: acceptable use, joiner-mover-leaver, incident response, and AI use. These cover the areas most likely to trigger external questions. The remaining policies should be written as auditors, insurers, and clients begin asking for them. A twenty-seat business does not need twelve polished documents on day one. It needs four current ones.

Who should write these policies?

The business owner should approve them. The IT supplier should draft them because they understand the technical context. Writing all twelve policies in one sitting is the fastest way to produce documents that do not reflect actual operations. Sessions of two hours, with the owner and the IT supplier present, produce better results than templates downloaded from the internet.

How long should each policy be?

A few pages at most. Most SME policies can be covered in one to two pages. If a policy requires more than two pages, it is probably covering too much. Short policies that staff actually read and that auditors can verify in minutes are more valuable than comprehensive documents that sit unread in a shared drive.

When is the best time of year to review IT policies?

February is a natural point for annual policy reviews, especially for businesses whose cyber insurance renewal date falls in the first half of the year. That is when policies get asked about, so it is logical to schedule reviews against that timeline. The key is consistency — reviewing annually, not ad hoc.

Your Next Step

If you cannot answer the question "what policies do we currently have?" with confidence, you are not alone. It is the most common gap we find in 10-to-25-seat SMEs.

The practical path forward is to start with a Security Triage Call. It gives you a clear picture of what exists today, what is missing, and what should be written first — ranked by what external parties will ask about next.

Book a Security Triage Call to get clarity on your current position.