Six ready-to-use policy templates aligned with Cyber Essentials Plus requirements: Acceptable Use, Password, Patch Management, Access Control, BYOD, and Incident Response.
Strong security policies are the foundation of Cyber Essentials Plus compliance. While the certification focuses on technical controls, having documented policies demonstrates that your security measures are formalised, repeatable, and understood across the organisation. This template pack provides six essential policy documents that you can customise for your business — each aligned with the specific requirements of the Cyber Essentials scheme. Every template includes fill-in fields for your organisation details, guidance notes explaining the rationale behind each policy statement, and references to the relevant CE+ control areas.
Business owners and IT managers who need professional, CE+-aligned security policy templates that can be quickly customised and implemented without starting from scratch.
Formal written policies are not a strict pass/fail requirement of the technical controls themselves, but assessors and clients increasingly expect documented policies as evidence that controls are consistently applied rather than ad hoc. Most UK SMEs pursuing certification adopt at least an acceptable use, password, and incident response policy.
A solid policy typically requires minimum password length of 12 to 14 characters, mandatory multi-factor authentication on all cloud and remote access accounts, account lockout after repeated failed attempts, and no forced periodic changes unless there is evidence of compromise, aligning with current NCSC guidance rather than outdated rotation rules.
Most organisations review and test their incident response plan at least annually, or after any significant infrastructure change or actual security incident. Testing typically involves a tabletop exercise simulating a breach scenario to confirm escalation contacts, containment steps, and ICO notification timelines are understood by relevant staff.
Each of the six templates in this pack includes fill-in fields for organisation-specific details and guidance notes, making them adaptable across sectors, though regulated industries such as legal or financial services may need additional clauses to meet sector-specific compliance obligations.
Powered by industry-leading technologies including SolarWinds, Cloudflare, BitDefender, AWS, Microsoft Azure, and Cisco Meraki to deliver secure, scalable, and reliable IT solutions.
4 Sep, 2026
Most UK businesses do not discover a network problem from their monitoring platform. They discover it when the third person walks over to the IT desk and says...
3 Sep, 2026
Almost every office move IT budget we see arrives at the same shape: a removals quote, a furniture allowance, a signage line, a contingency of ten per cent,...
2 Sep, 2026
An IT support SLA is the only part of a managed service contract that tells you what happens on the worst day of your year, and it is routinely the least...