A cyber security policy template covering responsibilities, an asset register with proportionate controls, logging, incident response and backups, home working and suppliers.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on cyber security:

• Cybersecurity
• Malware, Anti-Malware and Patching
• Information Security Incidents and Ransomware
• Information Security knowledge base

Logo Update Service

Download this policy template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription. This policy is also included in the ISO 27001 Toolkit and the ISO 9001, ISO 14001, ISO 45001 and ISO 22301 toolkits, including the integrated toolkits that combine them, so the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like this policy prepared for your organisation along with the rest of your company policies, or help completing a Constructionline, SSIP or Common Assessment Standard application, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Cyber Security Policy Template

A cyber security policy template committing to manage cyber security effectively, so that systems can only be accessed by authorised users, information is correct and not compromised, and the network can withstand or recover from threats.

The policy has Approved By and Date Approved fields and carries a Public information classification, so it can be shared with workers, clients and other interested parties.

What the Cyber Security Policy Covers

• Commitments - protecting hardware, software and information, proportionate protection, awareness training for all, and compliance
• Scope - all wired and wireless networks and cloud services, reviewed at least once a year
• Responsibilities - top management overall, a nominated manager day to day, supported by an IT provider where used, and all users
• Identifying data and systems - an information asset register recording owners, importance and sensitivity
• Controls - firewalls and secure configuration, user access control with multi-factor authentication, malware protection, and security updates within 14 days
• Logging and monitoring - sign-ins, changes and security events logged, protected and reviewed
• Incident response - reported, contained, investigated and recorded
• Backups - regular, with a copy kept separate and restores tested
• Home and remote working - threats assessed and guidance given
• Suppliers - cyber security arrangements checked before approval and reviewed

Written for the Common Assessment Standard

The responsibilities, data and systems, logging, incident response and backups, home working and supplier sections cover the points the Common Assessment Standard (CAS) question set asks a cyber security policy to include.

Checked Against Cyber Essentials

The IT policies in the range have been checked against the Cyber Essentials requirements, so their rules on passwords, devices, access and updates do not contradict what a Cyber Essentials assessment asks for.

Who Needs a Cyber Security Policy?

Any organisation that relies on IT systems, and organisations completing pre-qualification based on the Common Assessment Standard, such as Constructionline Gold.

Included in the ISO 27001 Toolkit

This policy is part of the ISO 27001 Toolkit and is also included in the ISO 9001, ISO 14001, ISO 45001 and ISO 22301 toolkits and every alphaZ ISO toolkit that combines them.

Works with the Cyber Risk Assessment

The RA-BR8 Cyber Attack risk assessment covers cyber risks, information assets can be recorded on the F-IMS25 Information Assets Register, and the A-C Management System Cyber Security audit checklist can be used to audit the arrangements.

Document Control

The footer carries the policy number and title, information classification, version and page numbers, and the approval fields record who approved the policy and when, so it can be controlled with the rest of your management system documents and listed on a document register such as the F-IMS20 Document Register.

Related Policies

• P-20 Information Security Policy - information security
• P-48 Network Security Policy - network security
• P-88 Information Security Incident Management Policy - incident management