IT policy starter

[Company name] — IT policies (starter draft)

DRAFT — review with your attorney before use. Items in [brackets] need your decisions.

1. ACCEPTABLE USE POLICY

Purpose and scope: This policy applies to all employees, contractors and interns, and covers company devices, email, cloud services and Wi-Fi.

Expected behavior:
- Use company systems mainly for business.
- Keep passwords private and use multifactor authentication (MFA) where required.
- Lock your screen when stepping away.

Prohibited:
- Sharing accounts.
- Installing unapproved software.
- Moving company files to personal email or storage.
- Accessing data unrelated to your job.

Privacy and monitoring: [Whether and how company systems may be monitored — wording to be written with our attorney.]

Violations may lead to disciplinary action. Employees sign to acknowledge this policy.

2. MOBILE DEVICES AND BRING-YOUR-OWN-DEVICE (BYOD) POLICY

Personal devices may be used for work only if they meet these minimum requirements:
- A supported operating system with automatic updates turned on.
- A screen lock.
- Device encryption.

Permitted on personal devices: [list the work apps and data allowed].

Management: the company manages only work apps and work data on personal devices, not the whole device.

Lost or stolen devices must be reported the same day.
When someone leaves, company accounts and data are removed from their devices.
[Reimbursement or stipend arrangement, if any.]

3. ACCESS CONTROL AND OFFBOARDING POLICY

- Every person has their own account. Shared logins are not allowed unless documented and controlled.
- MFA is required for email, remote access, financial systems and administrator accounts.
- People get only the access their job needs. Access is requested by a manager, approved by the system owner and recorded.
- Access to sensitive systems is reviewed quarterly.
- A change in role triggers an access review.

Offboarding checklist (owner: [name/role]; completed on or before the last day):
1. Disable the person’s accounts and sign them out of active sessions.
2. Change passwords for any shared accounts they knew.
3. Recover company devices, keys and badges.
4. Transfer or preserve their email and files according to the retention policy.
5. Remove company data from personal devices under the BYOD policy.
6. Record that each step is complete.

4. DATA RETENTION AND DISPOSAL POLICY

We keep personal information only as long as there is a legitimate business need, then dispose of it securely.

Record category | Owner | Where stored | Keep for | How destroyed
Financial records | [ ] | [ ] | [period from accountant/attorney] | [ ]
Personnel files | [ ] | [ ] | [period from accountant/attorney] | [ ]
Customer records | [ ] | [ ] | [period from accountant/attorney] | [ ]
Email | [ ] | [ ] | [period from accountant/attorney] | [ ]
Backups | [ ] | [ ] | [period from accountant/attorney] | [ ]

Legal hold: deletion is suspended for any records related to expected litigation or an investigation.
Disposal: shred paper; wipe or destroy drives before equipment is discarded or resold.

5. INCIDENT REPORTING POLICY

An incident is anything that might put company systems or data at risk — for example a suspicious email, a lost laptop, an odd pop-up, or a payment request that doesn’t look right.

Report immediately, even if you’re not sure, to: [name, phone and email]. After hours: [after-hours contact].

Don’t delete evidence or try to fix it yourself. Honest, prompt reports will never be punished.

Behind this policy, our incident response plan names who coordinates the response and which outside parties to call (IT provider, insurer, bank, attorney). We test it at least once a year.

Policy owner: [name/role] · Next review: [date] · Employees review these policies at onboarding and yearly.