How to start protecting your company – Step 1: Design your Information Security Policy

Following last week's webinar, where we analysed the most common cybersecurity mistakes SMEs make, we are starting a series of practical content to help you protect your company and avoid a disaster.

👉 If you missed it, you can watch the full recording here: Click here to watch the webinar

Over the coming weeks we will present 7 key steps to start building a solid security foundation in your company, without large investments or technical knowledge. Today we begin with Step 1: Designing your Information Security Policy, the cornerstone of any cybersecurity strategy.

Why start with a security policy?

Because it is the cornerstone of any protection strategy. Without it, any attempt to protect your business will be like building a house without plans: disorganised, expensive and fragile.

An information security policy sets the direction, defines priorities and aligns the whole team around what matters most: protecting what makes your company work.

But before writing it… you need to think

It is not just about writing general rules such as "don't share passwords" or "use antivirus". Before writing anything, you need to reflect on what really matters in your business. And that starts with a single question:

What is an information asset?

An information asset is any data, document or system that has value for your company.

Don't think only about technology. Think about your business:

• What would happen if you lost all your contracts or client databases?

• Or if a third party accessed your prices, strategies or quotes?

• What if an employee accidentally downloaded malware and your whole server got encrypted?

• What if someone published sensitive client information and you faced a data protection penalty?

That is the information you need to protect. Because if it is compromised, your business could stop, lose clients or even face unaffordable fines.

Identify before you protect

Before writing your policy, spend a few minutes thinking about (or sketching on paper) your company's information flows. Here are some questions to help you:

• What kind of information does my company handle? (clients, employees, suppliers, finance, projects…)

• Where is that information stored? (on paper, on computers, in the cloud, on WhatsApp…)

• How is that information created? (forms, emails, calls, tools)

• How is it shared? (email, USB sticks, platforms, screenshots)

• Who has access to it? (the whole team, only some people, external parties)

• How is it disposed of when no longer useful? (deleted? archived? printed and thrown away?)

Answering these questions will help you understand what you need to protect and how, and write a policy that makes sense for your reality.

So… what is a security policy?

It is a formal, clear and short document that defines how your company protects its information. It puts in writing the basic rules everyone must follow to avoid mistakes, unauthorised access, information loss or legal non-compliance.

What should an SME security policy include?

It does not need to be long or technical. Here is a simple structure:

1. Purpose

Explain why it exists: to protect sensitive information about the business, clients and employees.

2. Scope

Who does it apply to? (employees, suppliers, collaborators, etc.)

3. General security rules

Examples:

• Use strong passwords and never share them.

• Do not install unauthorised software.

• Be careful when using personal devices for work.

• Report incidents or suspicious emails.

4. Roles and responsibilities

• Who reviews and updates the policy?

• Who manages incidents?

• Who must be informed when there is a problem?

5. Compliance

• What the consequences are if the rules are broken.

• How you make sure everyone knows the policy (training, announcements, etc.).

6. Review

• How often the policy will be reviewed (at least once a year, or after a major incident).

Who needs to know this policy?

Everyone who works with you. Security is not just the technical team's job. Most incidents happen because of human error: clicks on fake links, weak passwords, documents shared carelessly…

A well-explained policy raises team awareness and creates a security culture from the start.

What now?

Take 30 minutes this week to sit down and think about your company's information flows. Identify which data is key, where it is, who uses it and how it moves. Then write a simple, clear policy adapted to your reality. It doesn't matter if it isn't perfect: what matters is to start. Over time you can review, improve and adapt it.

Conclusion

There is no protection without direction. Your security policy is your compass. Without it, everything else (tools, services, controls) will be pointless spending. With it, every step you take will be aligned with what you really want to protect.