What Is a Security Policy?

Definition

A security policy is a written set of rules for how a business protects its information and systems: who can access what, how passwords and devices are handled, how data is stored and disposed of, and what happens when something goes wrong. It turns good intentions into expectations everyone can follow and an auditor can check.

How It Works

For a small business, a security policy is usually one core document plus a few short, specific policies, such as:

Acceptable use: what staff may do with company devices, email, and accounts.
Access control: how accounts are granted, reviewed, and removed, and where MFA is required.
Data handling and retention: where sensitive data may live, how it is shared, and when it is deleted.
Device and patching: encryption, screen locks, updates, and what happens with lost devices.
Vendors: what security is expected from outside providers.
Incident response: who to tell and what to do first.

NIST's Cybersecurity Framework 2.0 places policy under its Govern function, with outcomes such as "policy for managing cybersecurity risks is established" and is "reviewed, updated, communicated, and enforced." The FTC Safeguards Rule requires covered financial businesses to have a written information security program "appropriate to the size and complexity of your business."

A policy only works if it matches what people actually do. Each rule should name an owner, be backed by a technical control where possible, and be reviewed at least yearly and after major changes or incidents. Staff need to be trained on it.

Real-World Example

In October 2022, the FTC took action against the alcohol delivery marketplace Drizly and its CEO after a breach exposing data of about 2.5 million consumers. The FTC alleged the company did not "require employees to use two-factor authentication for GitHub, limit employee access to personal data, develop adequate written security policies, or train employees on those procedures." The FTC's proposed order required a comprehensive information security program and, unusually, would bind the CEO personally to security requirements at future companies he leads.

Why It Matters for a Small Business

Written policies are what insurers, auditors, regulators, and larger customers ask to see first. Without them, a business cannot show it had reasonable security, and the Drizly case shows regulators treat missing policies as a failure in themselves. Policies also prevent drift: the rules survive staff turnover, and new hires learn them on day one instead of picking up habits. Clear written rules also make onboarding faster and give managers something concrete to point to when a request breaks the rules.

How to Spot It / How DTS Handles It

Warning signs: no written policy at all, a template downloaded years ago that nobody has read, rules that do not match how the business works, no named owner, no review date, and staff who have never seen it.

DTS can help with drafting right-sized policies with the owner, tying each rule to a technical control, walking staff through them, and setting a yearly review date. Policies with legal or regulatory weight should also be reviewed by your counsel. See our vCISO service.

Related Terms

Acceptable use policy: the policy staff read most.
Security awareness training: teaching the rules.
Risk register: the risks policies respond to.
NIST Cybersecurity Framework (CSF 2.0): a framework to build policies on.
FTC Safeguards Rule: a rule that requires a written program.
Incident response: the plan a policy should point to.
Cyber insurance: applications ask about written policies.

Sources

FTC, FTC Takes Action Against Drizly and its CEO James Cory Rellas for Security Failures that Exposed Data of 2.5 Million Consumers (October 24, 2022): https://www.ftc.gov/news-events/news/press-releases/2022/10/ftc-takes-action-against-drizly-its-ceo-james-cory-rellas-security-failures-exposed-data-25-million
NIST, The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29 (February 26, 2024): https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
FTC, FTC Safeguards Rule: What Your Business Needs to Know (December 2024): https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know

Last updated October 14, 2026.