---
title: "Cybersecurity policies | DataRoad IT"
description: "Accounts and MFA, devices, email, permissions, backups, incidents and leavers: seven cybersecurity policies that close the doors attackers use…"
language: en
url: https://www.dataroad-it.com/en/seven-cybersecurity-policies-every-company/
source: https://www.dataroad-it.com/en/seven-cybersecurity-policies-every-company/
publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal
---

> Accounts and MFA, devices, email, permissions, backups, incidents and leavers: seven cybersecurity policies that close the doors attackers use…

# Cybersecurity policies: the 7 every company must have

At a glance For decision-makers short on time.

- 01 Without written rules, an employee's mistake is not even a breach of policy.
- 02 Seven policies: accounts and MFA, devices, email, permissions, backups, incidents, leavers.
- 03 Each fits on half a page, signed by everyone and reviewed once a year.
- 04 DataRoad provides the templates and checks technical compliance in the monthly report.

### In this article

A reused password or a "invoice" opened by mistake can cost weeks of operation. In most SMEs, that mistake is not even anyone's fault: the company simply never wrote the rules down. **Cybersecurity policies** fix that with seven short sheets, one per topic, that the whole team reads and signs. They are the foundation of the managed cybersecurity DataRoad - IT Services and Consulting implements for its clients.

## Why does a "compliant" employee open the door to an attack?

Because they did what seemed normal. They used their email password on the courier's portal. They plugged in a USB stick from home. They lent their password to the intern "just for today". Without a written rule, none of this is forbidden. A policy is not a legal document: it is half a page on what to do and what not to do.

## Which seven cybersecurity policies should you have in writing?

| # | Topic | Answers |
| --- | --- | --- |
| 1 | Accounts and MFA | How do we protect every login? |
| 2 | Devices | Which equipment may touch the data? |
| 3 | Email | What do we do with a suspicious message? |
| 4 | Permissions | Who can see what? |
| 5 | Backups | Can we recover? |
| 6 | Incidents | Who does what on the worst day? |
| 7 | Joiners and leavers | Which access do we open and close? |

## 1. How are accounts protected?

- **Phrases, not codes** 14 characters or more, instead of short words full of symbols.
- **One credential per service** Stored in the company password manager; never sent by email or chat.
- **MFA without exceptions** Email, files and remote access. Management too: it is the favourite target.
- **Shared accounts** A new credential whenever someone leaves the company.

The details are in [how to choose and use a password manager](https://www.dataroad-it.com/en/business-password-manager/).

## 2. Which devices may access the data?

Company devices, with active protection, automatic updates and an encrypted disk. Personal devices only through the browser, without saving files locally. A laptop never spends the night in the car. If it goes missing, report it the same day and access is blocked remotely. Software only from the approved list, which must exist.

## 3. What should you do with a suspicious email?

Do not click, do not reply, forward it to IT. A supplier's change of IBAN is always confirmed by phone, to a number you already had, never the one in the email. That is what stops the [altered-IBAN invoice fraud](https://www.dataroad-it.com/en/email-fraud-changed-iban-ceo-fraud/). Client data never travels via personal email or messaging apps.

## 4. Who can see what?

- **Least necessary** Everyone accesses what their role requires, nothing more.
- **Review every six months** Shared folders and SharePoint.
- **Local admin rights** IT team only.
- **Third parties** Named access, with an expiry date and logging.
- **Change of role** The old access is removed; the new one is not simply added on top.

It is the least-privilege principle of the [Zero Trust model adapted for SMEs](https://www.dataroad-it.com/en/zero-trust-sme-90-day-plan/).

## 5. If everything were encrypted tomorrow, could you recover?

Only with a policy stating what is copied, how often, where to and for how many days it is kept. At least one copy off-site and immutable: ransomware cannot delete it. Restores tested on set dates, with the result recorded. Someone responsible for failure alerts, with a deadline to act. Find out how our [managed backup](https://www.dataroad-it.com/en/managed-backup-services-portugal/) works and what a [disaster recovery](https://www.dataroad-it.com/en/disaster-recovery-services-portugal/) plan adds.

## 6. Who does what on the day of an attack?

- **Alert chain**: who calls whom, and in what order.
- **Isolation**: the affected workstation comes off the network; the whole server does not.
- **Spokesperson**: one person talks to clients and suppliers; the others do not.
- **Legal deadlines**: the CNPD (Portuguese data protection authority) within 72 hours if personal data is involved; the National Cybersecurity Centre if the company falls under NIS2.
- **Printed contacts**: IT partner and insurer, because email may be down.

Place each step within the [four phases of a cyberattack](https://www.dataroad-it.com/en/cyberattack-four-phases-managed-cybersecurity/).

## 7. Which access is opened and closed with each person?

**On day one:** an account with the role's permissions, MFA switched on, equipment handed over and logged, and half an hour on these rules. **On the last day:** account disabled that day, not a week later; email forwarded; equipment returned and checked; shared credentials changed; third-party access linked to that person cut off. Former employees' accounts still active are among the most frequent failures in our audits.

## How do you move from paper to practice in a few weeks?

Half a page per policy. Start with what you already do well, add what is missing and cut unrealistic bans: a rule nobody follows discredits the rest. Management approval, a short session with the team, everyone's signature, an annual review.

In our [managed cybersecurity](https://www.dataroad-it.com/en/managed-cybersecurity-services/) contracts we deliver these seven templates tailored to each client and confirm technical compliance in the monthly report: MFA on, accounts disabled, backups tested. In 11 years, DataRoad has never suffered a security incident.

## Questions from decision-makers

### With 12 people, is it worth writing policies?

Yes: they are the same seven, just shorter. Risk does not shrink with size, and in a small team a forgotten account of someone who left weighs even more.

### Are we covered for GDPR and NIS2?

Partly. These policies form part of the required technical and organisational measures, but they do not replace the record of processing activities (GDPR) or the risk analysis (NIS2): they provide the foundation for them.

### Who has to sign?

Everyone with access to systems: management, interns and temporary staff included. Without a signature, there is no way to enforce them.

### How often are they reviewed?

Once a year, and whenever something relevant changes: a new ERP, wider remote working, an incident or new legislation.

## Next step: the seven policies, adapted to your company

We give you the templates, adapt them to your company and configure the technical side (MFA, permissions, backups) so that what is written is what actually happens. See [DataRoad managed cybersecurity](https://www.dataroad-it.com/en/managed-cybersecurity-services/) and request a no-commitment proposal.

**More than 10 workstations · support contract · remote, on-site and phone support.**

Call +351 211 459 950 * or write to sales@dataroad.pt.

**Call to a Portuguese landline.*

Chosen by respected and international companies

★★★★★ 5,0 · 52 Google reviews

★★★★★ 5,0 · 52 Google reviews

DataRoad

## Related articles

[Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/)

Numbers you can verify

**11** years in business

**232** clients

**< 10 min** average response time

**15+** IT vendor certifications

**10+** Countries with clients supported

**5.0 ★** 52 Google reviews

Transparency

## What many providers hide, we publish.

[See plans and prices →](https://www.dataroad-it.com/it-unlimited/)

- **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200.
- **No lock-in** Annual contract, no lock-in and no joining fees.
- **Everything in writing** What is included, the scope and the price, before you sign.
- **Support without counted hours** Remote and phone in every plan; on-site support from Premium.

Partners and certifications

DataRoad · Managed cybersecurity

## One StepAhead of IT.

The risk belongs to the board, the protection is ours. In 11 years, DataRoad has never suffered a security incident.

- **Top 5%** SMEs · scoring.pt
- **11** years in business, since 2015
- **0** DataRoad security incidents in 11 years

We do **IT** right.

DataRoad IT Unlimited

## Does your IT depend on a single person?

Documentation, inventory and one contact who answers for everything.

[Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente)

---
Versão HTML desta página: https://www.dataroad-it.com/en/seven-cybersecurity-policies-every-company/