Cybersecurity policies: the 7 every company must have

Because they did what seemed normal. They used their email password on the courier's portal. They plugged in a USB stick from home. They lent their password to the intern "just for today". Without a written rule, none of this is forbidden. A policy is not a legal document: it is half a page on what to do and what not to do.

• Phrases, not codes 14 characters or more, instead of short words full of symbols.
• One credential per service Stored in the company password manager; never sent by email or chat.
• MFA without exceptions Email, files and remote access. Management too: it is the favourite target.
• Shared accounts A new credential whenever someone leaves the company.

The details are in how to choose and use a password manager.

Company devices, with active protection, automatic updates and an encrypted disk. Personal devices only through the browser, without saving files locally. A laptop never spends the night in the car. If it goes missing, report it the same day and access is blocked remotely. Software only from the approved list, which must exist.

Do not click, do not reply, forward it to IT. A supplier's change of IBAN is always confirmed by phone, to a number you already had, never the one in the email. That is what stops the altered-IBAN invoice fraud. Client data never travels via personal email or messaging apps.

• Least necessary Everyone accesses what their role requires, nothing more.
• Review every six months Shared folders and SharePoint.
• Local admin rights IT team only.
• Third parties Named access, with an expiry date and logging.
• Change of role The old access is removed; the new one is not simply added on top.

It is the least-privilege principle of the Zero Trust model adapted for SMEs.

Only with a policy stating what is copied, how often, where to and for how many days it is kept. At least one copy off-site and immutable: ransomware cannot delete it. Restores tested on set dates, with the result recorded. Someone responsible for failure alerts, with a deadline to act. Find out how our managed backup works and what a disaster recovery plan adds.

1. Alert chain: who calls whom, and in what order.
2. Isolation: the affected workstation comes off the network; the whole server does not.
3. Spokesperson: one person talks to clients and suppliers; the others do not.
4. Legal deadlines: the CNPD (Portuguese data protection authority) within 72 hours if personal data is involved; the National Cybersecurity Centre if the company falls under NIS2.
5. Printed contacts: IT partner and insurer, because email may be down.

Place each step within the four phases of a cyberattack.

On day one: an account with the role's permissions, MFA switched on, equipment handed over and logged, and half an hour on these rules. On the last day: account disabled that day, not a week later; email forwarded; equipment returned and checked; shared credentials changed; third-party access linked to that person cut off. Former employees' accounts still active are among the most frequent failures in our audits.

Half a page per policy. Start with what you already do well, add what is missing and cut unrealistic bans: a rule nobody follows discredits the rest. Management approval, a short session with the team, everyone's signature, an annual review.

In our managed cybersecurity contracts we deliver these seven templates tailored to each client and confirm technical compliance in the monthly report: MFA on, accounts disabled, backups tested. In 11 years, DataRoad has never suffered a security incident.

We give you the templates, adapt them to your company and configure the technical side (MFA, permissions, backups) so that what is written is what actually happens. See DataRoad managed cybersecurity and request a no-commitment proposal.

More than 10 workstations · support contract · remote, on-site and phone support.

Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.