Audit-Ready: The 6 Security Policies Every Business Must Have

After years consulting for SMBs, I've seen the same mess repeat: either zero written policies, or bloated 200-page enterprise tomes nobody reads—and it's painfully obvious when AI cranked them out. Neither works. Here are the 6 policies that auditors (and cyber insurance questionnaires) actually ask for, and that are genuinely useful for small/medium businesses: 1. Information Security Policy** The "master" policy. 1-2 pages max. Says "we care about security" and points to everything else. Executive signature at the bottom. 2. Acceptable Use Policy (AUP)** What employees can/can't do with company tech. Should cover personal use, prohibited activities, BYOD, and the monitoring disclosure. This is the policy everyone signs on day one. 3. Password & Authentication Policy** Please stop requiring 90-day password changes — NIST updated their guidance years ago. Modern policy = 12+ char minimum, MFA everywhere external, approved password manager. No SMS for 2FA. 4. Remote Work Security Policy** Post-COVID, this is non-negotiable. Cover home network requirements (WPA2/3, not default router password), VPN rules, public WiFi (always VPN), and what to do if a device gets lost. 5. Data Classification Policy** Keep it simple: 3 levels. Confidential (encrypt, need-to-know), Internal (keep in company systems), Public (marketing materials). When in doubt, treat it as confidential. 6. Incident Reporting Policy** Your employees are your best security sensors — but only if they know what to report. Make reporting easy, respond fast, and have a non-retaliation clause. People won't report if they think they'll get blamed. **Tips for writing them:** - Write for humans, not lawyers. If you wouldn't say it out loud, don't write it. - 2-4 pages each, max. If nobody reads them, they don't work. - Include real examples of what's OK and what's not. - Review annually (put it on the calendar). - Actually enforce them. Inconsistent enforcement teaches people security doesn't matter. These 6 policies will cover the basics for SOC 2, ISO 27001, GDPR Art. 32, and most cyber insurance questionnaires. No, I will not ask you for your policies, already read 2 today, so nah...maybe tommorow :)