Company Cybersecurity Policy: Protecting Business Data

A company cybersecurity policy is the set of rules every employee follows to keep business data and systems safe: how to manage passwords and accounts, which devices and networks may be used, how data is shared, and what to do the moment something looks wrong. It applies equally to office, hybrid and remote staff. In India, it also needs to support two legal duties: reasonable security safeguards for personal data under the DPDP Act, 2023, and reporting specified cyber incidents to CERT-In within 6 hours.

Many breaches start with something ordinary: a reused password, a convincing phishing email, a laptop left in a cab, or a file shared with “anyone with the link”. Technology helps, but the policy decides how people behave. This guide explains what to include, gives a sample outline that works for remote and office teams, covers India and global notes, and lists common mistakes.

Why cybersecurity needs written rules, not assumptions

Without documented guidance, every employee makes their own judgement calls. One person uses a password manager; another keeps passwords in a notes app. One team shares client files through the approved drive; another uses a personal messaging app. Over time, the gaps add up quietly.

A written policy replaces guesswork with a single standard. It also makes accountability fair: you can only hold people to rules they have been told about and acknowledged.

Cybersecurity is everyone’s responsibility

Cybersecurity is not only the IT team’s job. Every employee who opens an email or a shared document is part of the defence. The UK’s National Cyber Security Centre makes the same point in its small business guide, which focuses on backups, protecting devices and accounts, and spotting scams.

Split responsibilities clearly:

Who	Responsible for
Leadership	Approving the policy, funding tools and training, owning the response to serious incidents
IT or security lead	Technical controls, access management, monitoring, backups, incident handling, regulator reporting
HR	Policy communication, acknowledgements, onboarding and exit steps, disciplinary process
Managers	Approving access for their team, reinforcing the rules, escalating concerns quickly
Every employee	Following the rules, protecting credentials and devices, reporting anything suspicious

What a company cybersecurity policy should cover

1. Accounts, passwords and multi-factor authentication

• Unique, strong passwords or passphrases for every work account; no reuse of personal passwords.
• An approved password manager, if the company provides one.
• Multi-factor authentication on email, cloud storage, finance and HR systems.
• Never share credentials, including with colleagues or IT, and never type them into links received by email.

2. Access control

Grant access by role and on a need-to-know basis. Managers approve requests; IT reviews access regularly; access is removed on role change and on the last working day. Shared and generic accounts should be avoided or tightly controlled.

3. Devices

• Company devices must have screen locks, encryption where available, current updates and approved security software.
• State whether personal devices may access company data, and the minimum protection they need.
• Do not install unapproved software or browser extensions on work devices.
• Report lost or stolen devices immediately so access can be blocked.

Keep this consistent with your employee cell phone policy.

4. Email, internet and AI tools

Explain how to spot phishing: unexpected urgency, payment change requests, mismatched sender addresses, and links to login pages. Require a call-back check on any request to change bank details. Set rules for acceptable internet use, which your employee internet usage policy can cover in more detail, and list which online and AI tools are approved for company information.

5. Data handling and backups

Classify data into simple levels, for example public, internal and confidential, and say how each may be stored and shared. Use approved storage only, restrict “anyone with the link” sharing, and keep regular backups that are tested. The behaviour rules for sensitive information belong in your employee confidentiality policy; the cybersecurity policy sets the technical standard.

6. Incident reporting and response

Tell employees exactly what to report (a suspicious email they clicked, a lost device, unusual account activity, a file sent to the wrong person), who to report it to, and that early reporting will not be punished. Behind the scenes, IT needs a response plan: contain, assess, notify where required, recover and review.

Rules for remote and office teams

Security standards must be the same wherever people work, but the risks differ. Write location-specific rules into one policy rather than separate documents.

Area	Office	Remote or hybrid
Network	Company network only; guest Wi-Fi for visitors	Secure home network; company VPN where required; avoid public Wi-Fi for confidential work or use the VPN
Screens and paper	Clear desk, locked screens, visitors escorted	Work out of sight of others; no printing confidential data at home unless approved
Devices	Company-managed devices	Company devices preferred; personal devices only if they meet the minimum standard
Calls and meetings	Book rooms for confidential discussions	Use headphones; avoid confidential calls in public places
Reporting incidents	Walk over to IT or use the helpdesk	Use the helpdesk or a named contact reachable across time zones

Focus on behaviour standards rather than surveillance. If you monitor work devices or networks, say so in the policy, explain why, and keep it proportionate.

India and global legal notes

• CERT-In directions. The CERT-In directions of 28 April 2022 under section 70B(6) of the IT Act, 2000 require service providers, intermediaries, data centres, body corporates and government organisations to report specified cyber incidents to CERT-In within 6 hours of noticing them or being told about them. The listed incidents include unauthorised access to systems or data, data breaches and leaks, ransomware and other malicious code, phishing and identity theft, and unauthorised access to social media accounts. The same directions require logs of all ICT systems to be kept securely for a rolling 180 days within India, clocks to be synchronised to approved time sources, and a designated Point of Contact for CERT-In. Check the CERT-In directions page for current reporting formats and any updates.
• DPDP Act. Under the Digital Personal Data Protection Act, 2023, organisations must protect personal data with reasonable security safeguards and notify the Data Protection Board and each affected individual of a personal data breach (section 8). The DPDP Rules, 2025 were notified in November 2025 with an 18-month phased compliance timeline, per the Press Information Bureau. A single personal data breach can therefore trigger both CERT-In and DPDP notifications, so your response plan should cover both.
• Other countries. Many countries have their own breach notification and security rules, often with fixed deadlines. If you hold data on people abroad, list each country’s reporting duty in the incident plan.

Sample cybersecurity policy outline

1. Purpose and scope: protects company data and systems; applies to all employees, contractors and vendors, in the office and remotely.
2. Roles: leadership, IT or security lead, HR, managers, employees.
3. Accounts: unique passwords, password manager, multi-factor authentication, no sharing.
4. Access: role-based, approved by managers, reviewed [quarterly], removed on exit.
5. Devices: minimum standards for company and personal devices; lost devices reported at once.
6. Email, internet and AI tools: phishing checks, call-back rule for payment changes, approved tools list.
7. Data: classification levels, approved storage, sharing rules, backups.
8. Remote work: network, screen privacy, printing and call rules.
9. Incidents: what to report, to whom, how fast; regulator reporting handled by [role], including CERT-In and DPDP duties.
10. Training: at induction and at least [annually], plus phishing awareness.
11. Breaches of policy: handled fairly; good-faith reporting is never punished.
12. Review: annually and after any significant incident.

Example: an accounts executive working from home receives an email that appears to come from a regular supplier, asking to update bank details. The policy’s call-back rule means they phone the supplier on the number already on file, discover the email is fake, and report it. IT blocks the sender and alerts other staff the same day.

Onboarding and exit: where policies fail most

New joiners need accounts, devices and training before they handle data, so add security steps to your employee onboarding checklist: policy acknowledgement, multi-factor setup, and a short phishing briefing. At exit, remove access on the last day, collect devices, and transfer ownership of shared files.

Common mistakes to avoid

• Writing for IT, not for employees. Use plain language and examples; put technical standards in an annex.
• Punishing people who report mistakes. Fear delays reporting, and in India the reporting clock can be short.
• No named owner for regulator reporting. Decide in advance who reports to CERT-In and who handles DPDP notifications.
• Ignoring remote work. Office-only rules leave home networks and personal devices uncovered.
• Access that never expires. Former employees and old vendor accounts are a common way in.
• Untested backups. A backup you have never restored is a hope, not a control.
• Annual review skipped. Tools, threats and laws change quickly.

Keeping the policy alive

Collect acknowledgements at onboarding and after major updates, run short refreshers, and review the policy after every significant incident. To get a structured first draft, you can use the HRTailor.AI HR policy builder and then have your IT lead add the technical standards.

Last reviewed: 26 October 2026. General information, not legal or tax advice.

Official sources

• CERT-In directions under section 70B(6) of the IT Act, 2000, dated 28 April 2022
• CERT-In directions page and FAQs
• Digital Personal Data Protection Act, 2023
• Government notifies DPDP Rules (PIB)
• Small Business Guide (UK National Cyber Security Centre)

Related reading

• Leave Policy Explained: Types of Leave Every Company Needs
• What Are the Essential HR Policies a Growing Company Cannot Skip