Introducing the 2025 IT Policies Template

Background

Our IT Policy template contains the minimum practices for managing your organisation’s technology to meet Cyber Essentials (CE) requirements and to underpin your GDPR without merely ticking boxes, and critically, these practices will also efficiently and effectively help you to remain compliant.

Below we have provided a summary for each policy, some business justification, notes on how the policy aligns with CE and/or GDPR, and an outline of the necessary implementation tasks. The Policy template pack contains the additional supporting documents required for recording policy compliance.

Please note:

• • For GDPR compliance, additional tasks/policies will be required.
  • Whilst certifications such as CE only assess your compliance at one point during the year, you are expected to stay compliant continually.
  • The implementation works are not included in the template cost as these can be carried out by you. If you would prefer this work to be completed by us, we would be happy to provide a formal quote.
  • Although you can achieve CE/GDPR by doing less in some areas, based on a century of IT experience, we would recommend you adopt these as your minimum practice.

Summary of IT Policies:

Password Policy – Password management is the responsibility of every member of staff. Unauthorised access to systems using an unprotected password could cause a great deal of reputational or financial damage to the organisation. This policy is required for Cyber Essentials Access Control.

Data Location and Access Policy – It is important for every user to ensure that they only save information where they are supposed to, otherwise that data is at risk of being accessed by people outside the organisation or without the proper credentials. The organisation needs to mandate, and wherever possible, control, where people save data. This policy underpins your GDPR compliance.

Privacy Policy – Under GDPR legislation, people need to know what you are doing with their data and why you have asked for it. It is up to you to ask only for the data you legitimately require and the justification for needing the data must be publicly documented. The organisation also has a legal responsibility to safeguard the data, as legally, the data remains the property of the people who provided it to the organisation. This policy underpins your GDPR compliance.

Data Retention Policy – You must comply with GDPR and have a responsibility to ensure you understand what data you hold, where it is stored and how long it needs to be kept for. If data is lost due to an incident, the less that is lost and the more its content is understood, the more it will mitigate the penalties. This policy underpins your GDPR compliance.

AI Usage Policy – Artificial Intelligence (AI) is becoming more useful for organisations, but it can come with significant hidden risks. AI uses any data you give it to train itself and it stores that data too. There are mitigations and subscriptions that can reduce the threat, but the danger needs to be understood by everyone in the organisation, and the knowledge imparted as to what they should and should not do. This policy underpins your GDPR compliance.

Data Backup Policy – It is the company’s legal responsibility to protect any data that pertains to staff or clients. Companies do not typically survive the loss of their data. For both reasons, data backups are critical. For this, all data locations need to be identified and regularly reviewed in line with the policy to ensure the correct levels of backup. Backups should be automated without the requirement for manual intervention. This policy underpins your GDPR compliance.

Disaster Recovery and Business Continuity Planning Policy – It is essential to match the backup function to your specific needs. These policies help to review and understand the organisation’s need for each of the data services. This policy underpins your GDPR compliance.

Encryption Policy – Encryption can prevent unauthorised access to data on stolen or mislaid devices. Even if someone removes the disk from a stolen device, any data saved on it cannot be accessed on another computer without the encryption key. This policy underpins your GDPR compliance.

Patching and Updates Policy – Patches are released to deal with discovered vulnerabilities that could allow someone to take control of your device, login to your systems, or impersonate you. This policy is required for Cyber Essentials Patching and Updates.

Risks and Issues Policy –This log is for you to record where you have assessed and accepted any risks arising from equipment that does not comply with the legislation. It includes any plans to replace systems with compliant ones and records any mitigations, so that you fully understand what mitigations and risks might be associated with your IT. This is a general policy.

Security Awareness Policy – All users should be given ongoing Security Awareness Training for constant awareness of the latest breech tactics and changing security threats that threaten your organisation. This is a general policy.

Certification Policy – All systems used to store the organisation’s data that are not under the organisation’s direct control must also fully comply with the UK GDPR policies, and their compliance must be checked. This policy underpins your GDPR compliance.

Secure Configuration and System Commissioning/Decommissioning Policy – It is extremely important for every user to fully understand this section of the policy, as there is potential for lethal viruses, hacking and critical data loss if the policy is not followed when connecting with unmanaged devices or using unmanaged devices to access organisation data. This policy is required for Cyber Essentials Secure Configuration.

Software Policy – Hackers can easily build in back doors to software and then access the organisation’s system. Users need to understand the risks when installing software or using administrative accounts for day-to-day access. This policy is required for Cyber Essentials Secure Settings.

Bring Your Own Device (BYOD) Policy – Organisation managed devices are actively configured for security, protected from attack and monitored. Any use of unmanaged personal devices significantly puts the organisation’s data at risk. This policy is required for Cyber Essentials Secure Settings.

Working Away from the Office Policy – Wherever they are located when working, users should only ever use the organisation’s equipment, or they will risk putting the organisation’s data and systems in danger. This policy is required for Cyber Essentials Secure Settings.

Commissioning System External Access Policy – Misconfigured or unnecessary firewall rules allowing inbound access could cause serious security issues. This could potentially lead to people accessing systems and data without permission or encrypting your data. This policy is required for Cyber Essentials Secure Settings.

Malware Protection Policy – Grace Solutions recommends a managed solution over an individually installed one, as anti-malware is too important a task for end users to police themselves. It is vital that the anti-malware is fully functional and up to date. This policy is required for Cyber Essentials Malware.

IT Equipment Policy – Equipment must be cared for and maintained to ensure it remains fully operational and secure and to allow necessary replacements to be scheduled and budgeted. This is a general policy.

Firewall Protection Policy – If a rogue device enters a network, it can find misconfigured devices and wreak havoc, including stealing or encrypting data. However, this is preventable with the installation of a correctly configured firewall. This policy is required for Cyber Essentials Firewall.

Monitoring and Audit Policy – Keeping accurate records of what devices, systems and applications are in your  environment allows you to plan, budget and check they are correctly configured and to restrict access where needed. This policy is required for Cyber Essentials and contributes to your GDPR responsibilities.

User Creation, Change and Deletion Policy – You must know what accounts exist and what each account has access to. This policy is required for Cyber Essentials and contributes to your GDPR responsibilities.

Remote Access to Systems from Third Parties Policy – The security policy is completely negated if the wrong person is given access to your systems. There may be occasions when other organisations will need access to your systems, but these should always be fully appraised and understood before access is granted. This policy is required for Cyber Essentials and contributes to your GDPR responsibilities.

Change Control Procedures Policy – It is important that you understand what changes are being made to the environment and systems, so that these can be implemented with the least impact and cost to the organisation. This is a general policy.

Email Use Policy – It is important that all employees use email appropriately to minimise risk to the organisation. This policy is required for Cyber Essentials and contributes to your GDPR responsibilities.

Internet Use Policy – It is important that all employees use the Internet appropriately to minimise risk to the organisation. This policy is required for Cyber Essentials and contributes to your GDPR responsibilities.

Incident Response Procedure Policy – Reacting fast and effectively to an incident will makes a huge impact on the amount of damage caused to the organisation. This policy contributes to your GDPR responsibilities.

Implementation Tasks

The following table contains a summary of information and tasks related to each of the policies – in particular:

• • Whether or not the policy needs to be customised to the specific client’s needs.
  • Whether the policy contributes towards compliance with either GDPR or Cyber Essentials.
  • What essential tasks need to be completed for the successful implementation of the policy.

There are three implementation tasks common to all policies, so not explicitly listed in the table:

• 1. Adopt and configure – no policy is useful until it’s been configured for the specific client where relevant and formally adopted.
  2. Create, monitor and report on technical controls – it’s minimally effective to introduce a policy that is not monitored, so where possible, technical controls should be created and monitored to ensure there is ongoing policy compliance.
  3. Train staff – policies that are adopted without training result in poor effectiveness – for all policies, relevant staff should receive appropriate instruction on how to use and comply with the policy.