--- title: Do You Need a Cyber Security Policy? description: Only 52% of UK small businesses have a cyber security policy. Find out what yours should cover after October's breaches. image: https://noble-it.co.uk/hubfs/do-you-need-cyber-security-policy-noble-it.jpg --- [Skip to the main content.](https://noble-it.co.uk/blog/do-you-need-cyber-security-policy#main-content) [![Noble IT Logo](https://noble-it.co.uk/hs-fs/hubfs/Branding/Noble%20it_Black_Green-1.png?width=200&height=41&name=Noble%20it_Black_Green-1.png "Noble IT Logo")](https://noble-it.co.uk) [![Noble IT Logo](https://noble-it.co.uk/hs-fs/hubfs/Branding/Noble%20it_Black_Green-1.png?width=150&height=31&name=Noble%20it_Black_Green-1.png "Noble IT Logo")](https://noble-it.co.uk) - Services - [IT Support](https://noble-it.co.uk/services/it-support) - [Cyber Security](https://noble-it.co.uk/services/cyber-security) - [IT Management & Consulting](https://noble-it.co.uk/services/it-management-and-consulting) - [Tier 4 Service Escalation](https://noble-it.co.uk/services/tier-4-service-escalation) - [Unified Communications & Connectivity](https://noble-it.co.uk/services/unified-communications-and-connectivity) - [Disaster Recovery & Business Continuity](https://noble-it.co.uk/services/disaster-recovery-and-business-continuity) - Resources - [Blog](https://noble-it.co.uk/blog) - [About Us](https://noble-it.co.uk/about-us) - [Contact Us](https://noble-it.co.uk/contact) Search [Talk to us](https://noble-it.co.uk/contact) Toggle Menu Search Toggle Menu [Talk to us](https://noble-it.co.uk/contact) - Services - [IT Support](https://noble-it.co.uk/services/it-support) - [Cyber Security](https://noble-it.co.uk/services/cyber-security) - [IT Management & Consulting](https://noble-it.co.uk/services/it-management-and-consulting) - [Tier 4 Service Escalation](https://noble-it.co.uk/services/tier-4-service-escalation) - [Unified Communications & Connectivity](https://noble-it.co.uk/services/unified-communications-and-connectivity) - [Disaster Recovery & Business Continuity](https://noble-it.co.uk/services/disaster-recovery-and-business-continuity) - Resources - [Blog](https://noble-it.co.uk/blog) - [About Us](https://noble-it.co.uk/about-us) - [Contact Us](https://noble-it.co.uk/contact) ##### Managed IT Services - [IT Support](https://noble-it.co.uk/services/it-support) - [Cyber Security](https://noble-it.co.uk/services/cyber-security) - [IT Management & Consulting](https://noble-it.co.uk/services/it-management-and-consulting) - [Tier 4 Service Escalation](https://noble-it.co.uk/services/tier-4-service-escalation) - [Unified Communications & Connectivity](https://noble-it.co.uk/services/unified-communications-and-connectivity) - [Disaster Recovery & Business Continuity](https://noble-it.co.uk/services/disaster-recovery-and-business-continuity) ##### [![Schedule your 360 review   Let's discuss how Noble IT can support your business.   No obligations—just a straightforward conversation with someone who knows IT.  ](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/25894449/interactive-390398591225.png)](https://noble-it.co.uk/hs/cta/wi/redirect?encryptedPayload=AVxigLIJZ7Yaf9nYo%2FUe8bQYidnCHqGWeU32v7i1Tqe27mcdEjp5tD4%2BMTckMo9hWPRC1jk7No070HMcebBE6AanY%2FdZ5fIm6YgEOK2liPs3V9x%2B2N%2BBl885gq1It8HcZpk3ofFmfrhgtAqqdwJu3tF%2F5QdFqtJwZO65psebGyRU9UtbVoPuwVSr96ksm9xao%2BR8%2Fr85oO2md3hWU3y%2B8Gc%3D&webInteractiveContentId=390398591225&portalId=25894449) 9 min read # Do You Need a Cyber Security Policy? [Adam Nichols](https://noble-it.co.uk/blog/author/adam-nichols) : Updated on November 5, 2026 [Cyber Security](https://noble-it.co.uk/blog/tag/cyber-security) [Professional Services](https://noble-it.co.uk/blog/tag/professional-services) ![Do You Need a Cyber Security Policy?](https://noble-it.co.uk/hubfs/do-you-need-cyber-security-policy-noble-it.jpg) On 6 October, ASOS customers picked up their phones to find a [push notification from the retailer's own app](https://www.ncsc.gov.uk/news/incident-affecting-asos-customers). ASOS hadn't sent it. Someone had impersonated a trusted contact, talked an employee out of their login, and used it to reach customer data held on third-party platforms the company uses. Around the same time, security researchers reported that one compromised login for a cloud backup tool had given attackers a way into 173 businesses' Microsoft 365 environments. Neither needed a clever hacker. Each started with a login and a gap nobody had written down. So here are the questions worth asking in your business this week. Who has access to the tools your suppliers run for you? Who would your team call if a contact they know asked for something unusual? Who's patching your website right now? If the honest answer to any of those is "not sure", you need a [cyber security](https://noble-it.co.uk/services/cyber-security) policy. If you have employees, client data, an insurer, or clients who send you supplier questionnaires, you need one anyway. It doesn't have to be a 107-page document nobody reads. For most businesses of 20 to 100 people, the core of it fits on two pages. ## Do You Legally Need a Cyber Security Policy in the UK? For most private businesses, there is no legal requirement to have a document specifically called a cyber security policy. However, UK GDPR requires organisations to protect personal data through appropriate technical and organisational measures. A written cyber security policy helps demonstrate that these responsibilities are being taken seriously. In practice, the push usually comes from somewhere else first: - Your cyber insurer's renewal questionnaire asks whether you have one - A client's supplier due diligence form asks to see it - A tender, particularly in the public sector, asks for evidence of your security policies - You're preparing for Cyber Essentials, which is far easier when the rules are already written down There's also the question nobody wants to think about. If you ever have to report a breach to the ICO, being able to show a policy your team actually followed puts you in a very different position from having nothing at all. This isn't legal advice, and the[ICO's guidance on security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/) is the place to check your specific obligations. ## How Many UK Businesses Actually Have One? Just over half of small businesses. The government's[Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) found 52% of small businesses have a formal cyber security policy, down from 59% the year before. The risk didn't fall with it. In the same survey, 43% of businesses reported a breach or attack in the previous 12 months, rising to 46% of small businesses and 65% of medium-sized ones. Phishing hit 38% of businesses, and 69% of those affected said it was the most disruptive attack they faced. Only 25% of businesses have a formal plan for responding to an incident. We've broken down the[full 2026 breach data for SMEs](https://noble-it.co.uk/blog/small-business-cyber-security-breaches-survey-2026) separately. Awareness isn't the problem. Most Managing Directors know attacks happen to businesses their size. What's missing is the step from knowing it to writing down what everyone should do about it. ## What Did October 2026 Show About the Gaps? Each of this month's biggest incidents maps to a line that belongs in a cyber security policy. Most businesses don't have that line yet. ### The Trusted Contact Who Wasn't ASOS has said the attacker got into an employee account by impersonating a trusted contact, then used those credentials to reach information on third-party platforms. The[NCSC told ASOS customers](https://www.ncsc.gov.uk/news/incident-affecting-asos-customers) to assume they were affected and not to click suspicious links, including in push notifications.[BBC News later reported](https://www.bbc.co.uk/news/articles/c3qjnwye0ep5o) that more detailed personal information had been taken than ASOS first indicated. The same trick turns up in smaller businesses constantly, usually as a quote request. Research from security firm Fortra found a twelvefold rise in malicious emails mentioning quotation requests between October 2025 and September 2026, with nearly 73% leading to pages built to steal logins. Sales and procurement employees are the main targets. "You can put in as many security platforms as you like, but if somebody clicks on a link and enters a password, they've handed you the keys," says Adam Nichols, Director at Noble IT. "More and more, we're seeing attacks rely on people's fatigue and catching them off guard." **What the policy should say:** how employees check an unusual request from a contact they know, and who they report it to. Every account that touches client data should use[multi-factor authentication](https://noble-it.co.uk/blog/multi-factor-authentication-mfa-guide). ### The Supplier With the Keys Security firm Huntress reported that attackers used a compromised credential for ConnectWise's Cloud Backup service to reach 173 Microsoft 365 environments. The backup app had broad permissions, so that one login could expose email, files and Teams data. In at least one case, the attackers added credentials to other trusted apps so they could get back in later. The government survey found only 15% of businesses review the cyber risks posed by their immediate suppliers. **What the policy should say:** keep a list of every third-party tool with access to your systems and what it can reach. Name who reviews those permissions, and how often. ### The Patch That Couldn't Wait On 21 October, the NCSC issued an alert about two critical flaws in PHP, the programming language behind a huge number of websites, including WordPress sites. Wiz, one of the security firms that helped uncover them, estimates PHP runs 70% of the world's websites. AI tools found flaws that had been sitting in the code for more than a decade. The NCSC advised organisations to apply updates as soon as they were available and to consider taking sites offline if they couldn't.[According to the BBC](https://www.bbc.co.uk/news/articles/cwly38gjkejko), Edinburgh council took pages down and the UK Government took 32 sites offline as a precaution. As of 23 October, no successful attacks had been reported, though Cloudflare saw exploitation attempts climb into the millions. Here's the part that catches smaller businesses out. Updating WordPress or its plugins doesn't fix this. The patch goes on PHP itself, which is usually your web host's or developer's job. Have you asked them whether it's done? Do you know who to ask? **What the policy should say:** who's responsible for updates on every system, including the ones a supplier manages for you, and how quickly critical patches must go on. ### The AI Tool Nobody Approved On 23 October, it was reported that an employee at a Panasonic subsidiary had uploaded HR data on around 330,000 people to a generative AI service the company had banned. There was no outside attacker involved. If your employees use AI tools at work, the real question is whether anyone has told them which ones are allowed and what can go into them. **What the policy should say:** which AI tools are approved, and what kinds of data must never be pasted into any of them. ## What Should a Cyber Security Policy Include? A policy for a business of 20 to 100 people should cover eight areas. Each one is a decision you write down in plain English, not a page of legal wording. You'll also see this called an information security policy. The terms are used interchangeably, and what matters is what's in it. ### Scope and Ownership Say who it applies to. That means employees, contractors, temps and anyone else with a login to your systems. Then say who's accountable for it, by job title. ### Passwords and Multi-Factor Authentication The NCSC recommends long passwords made of[three random words](https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/use-a-strong-and-separate-password-for-email), a password manager so employees don't reuse them, and multi-factor authentication on every account that offers it. It also advises against forcing people to change passwords on a schedule. Change them when there's a reason to. If your current password policy still asks for eight characters and a change every two months, it's working against current UK guidance. ### Devices, Remote Working and Personal Phones Which devices can access company data, and what has to be in place on them first. Screen locks and encryption are the minimum, with updates switched on. If employees use their own phones for work email (a BYOD policy), say what's allowed and what happens to company data if the phone is lost or the person leaves. ### Email, Messages and How to Report Them [Suspicious messages](https://noble-it.co.uk/blog/avoid-phishing-guide-uk-businesses) don't only arrive by email. ASOS customers got one through an app notification. Your policy should give employees one clear way to report anything odd, without blame, and a rule that any change to payment details is confirmed by phone on a number you already hold. ### Acceptable Use, Including AI Tools Your acceptable use policy sets out what employees can and can't do on company systems. In 2026, it needs a section on AI: which tools are approved, and what must never go into them. Client data, HR records and anything under NDA are the obvious starting points. ### Suppliers and Third-Party Access List every supplier or app with access to your systems and what it can reach. Review that access at least once a year, and remove anything nobody uses. ### Updates and Patching Name who updates each system, including the ones suppliers manage, and how quickly critical updates must be applied. "As soon as possible" isn't a timeframe. ### What Happens When Something Goes Wrong This is your[incident response plan](https://noble-it.co.uk/blog/cyber-incident-response-smes-first-hour), and it can start as a single page. Who's called first? Who decides whether to take a system offline? How and when do you tell clients? If personal data is involved, UK GDPR gives you 72 hours to report a notifiable breach to the ICO. When TFG London, the owner of Phase Eight, Hobbs and Whistles, detected an incident on 11 October, it activated its incident response and[business continuity plans](https://noble-it.co.uk/services/disaster-recovery-and-business-continuity) and brought in outside specialists. It reported the incident to the authorities, and its stores stayed open. Speaking to PA, Beverley Griffiths, senior lecturer in security and resilience at Bucks New University, said that "no organisation is immune", and that the real test is how quickly a business can detect an incident, respond, recover and keep customers informed. ## Is a Cyber Security Policy Template Good Enough? A template is a reasonable starting point and a poor finishing point. Many of the most popular ones are written for US HR teams, and some still carry the password rules the NCSC moved away from years ago. The bigger issue is that a template doesn't know your business. It can't tell you which suppliers have access to your Microsoft 365, or who actually patches your website. You don't need a 40-page "holistic cyber resilience governance framework". You need two pages your team will read, backed by the technical detail[your IT partner](https://noble-it.co.uk/services/cyber-security) keeps up to date. How far you go beyond that is a business decision. "You can spend a million or you can spend a tenner," says Adam. "The less you spend, the more risk you're accepting. So what does your risk appetite look like?" ## Who Should Own the Policy? In a business of 20 to 100 people, ownership usually splits between a few roles: - **Managing Director:** signs it off and makes clear it applies to everyone, including the leadership team - **Operations Manager or Office Manager:** owns it day to day, making sure new starters read it and leavers lose access on their last day - **Your IT partner:** keeps the[technical standards](https://noble-it.co.uk/services/it-management-and-consulting) behind it current and tells you when something needs to change According to the government survey, only 37% of small businesses and 52% of medium-sized ones have someone at board level responsible for cyber security. ## How Does a Policy Fit With Cyber Essentials and a Risk Assessment? Start with a risk assessment. Work out what data and systems you have, and which would hurt most if they were lost or exposed. Then write the policy around what you found.[Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview) is the independent check that the basic technical controls are actually in place. Most smaller businesses skip at least one of those steps. Only 41% of small businesses carried out a cyber security risk assessment, and just 12% hold Cyber Essentials. We've covered[what's changed in Cyber Essentials](https://noble-it.co.uk/blog/cyber-essentials-2025) in a separate post. In February, NCSC chief executive Richard Horne said many SMEs wrongly assume they're too small to be targeted. "That assumption is wrong," he wrote, urging every SME to put Cyber Essentials controls in place. ## How Often Should You Review Your Cyber Security Policy? At least once a year, and whenever something changes. The changes that should trigger a review are usually obvious once they're written down: - You bring in a new system or a new supplier with access to your data - The person who owns the policy leaves or changes role - You have an incident or a near miss - Your insurer sends a new questionnaire - Employees start using a new AI tool ## Frequently Asked Questions ### What's the Difference Between a Cyber Security Policy and an Information Security Policy? In most small and medium-sized businesses, very little. An information security policy can be broader and cover paper records and physical security as well as digital systems. A cyber security policy focuses on your digital systems and the data held in them. For a business of 20 to 100 people, one document covering both is usually the right call. ### Does a Small Business Need a Cyber Security Policy? If you have employees with access to client or personal data, yes. Only 52% of UK small businesses have one, yet 46% reported a breach or attack in the past year. A short policy that names who does what costs very little to put in place. ### What Is an AI Acceptable Use Policy? It sets out which AI tools your employees can use for work, and what information must never be entered into them. It can be a section of your main acceptable use policy rather than a separate document. ### Do Insurers Require a Cyber Security Policy? Many cyber insurance questionnaires ask whether you have one, alongside questions on multi-factor authentication and backups. Requirements vary by insurer and policy, so check yours. Having the answers written down makes renewal faster and puts you in a better position if you ever need to claim. ## Protect the Right Things Three fashion retailers made cyber security headlines in a single month. ASOS and TFG London confirmed attacks, while H&M investigated claims that it had been targeted. Inboxes filled up with IT firms selling the fix. Adam is blunt about what happens next. "Every time there's a breach in the news, there are 400 IT companies offering 400 solutions to make sure it doesn't happen to you. Nine times out of ten, it doesn't even relate to you. You don't need to spend a million pounds. You just need to protect the right things." A two-page policy is how you decide what the right things are. Someone has to own it and notice when it stops matching how the business works. For most of our clients, that's the part they'd rather[hand to us](https://noble-it.co.uk/services/it-support). ## Right. Let's Talk. A Noble IT 360 Review looks at your systems and suppliers, including how your Microsoft 365 is set up, then tells you in plain English where the gaps are and what to fix first. No obligations, and no hard sell. [Book Your 360 Review](https://noble-it.co.uk/book-360-review) ## Sources - [DSIT: Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) - [NCSC: Incident affecting ASOS customers](https://www.ncsc.gov.uk/news/incident-affecting-asos-customers) - [BleepingComputer: ASOS links data breach to social engineering attack](https://www.bleepingcomputer.com/news/security/asos-links-data-breach-to-social-engineering-attack-credential-theft/) - [BBC News: Phase Eight and Hobbs owner hit by cyber-attack, as H&M probes separate hack claim](https://www.bbc.co.uk/news/articles/c3qjnwye0ep5o) - [BBC News: What is PHP and why did it spark a global cyber-security scramble?](https://www.bbc.co.uk/news/articles/cwly38gjkejko) - [Help Net Security: TFG London cyberattack](https://www.helpnetsecurity.com/2026/10/14/tfg-london-cyberattack-phase-eight-hobbs-whistles/) - [Black Arrow Cyber: Threat briefing 23 October 2026](https://www.blackarrowcyber.com/blog/threat-briefing-23-october-2026) - [explainx: October 2026 cyberattacks tracker](https://explainx.ai/blog/october-2026-cyberattacks-list-breaches-exploits-ai-run-attacks-tracker-2026) - [Infosecurity Magazine: NCSC boss on SME cyber threat](https://www.infosecurity-magazine.com/news/sme-cyber-attack-threat-ncsc/) Share this article: [![Business Phone Systems: The Complete Guide for Oxfordshire Businesses](https://noble-it.co.uk/hubfs/Noble%20IT%20-%20Business%20Phone%20Systems%20The%20Complete%20Guide%20for%20Oxfordshire%20Businesses.jpg)](https://noble-it.co.uk/blog/business-phone-systems-guide) #### [Business Phone Systems: The Complete Guide for Oxfordshire Businesses](https://noble-it.co.uk/blog/business-phone-systems-guide) [Adam Nichols](https://noble-it.co.uk/blog/author/adam-nichols) : Aug 25, 2026 Confused by VoIP and the 2027 switch-off? A plain-English guide to business phone systems, costs and choosing the right one. No bull. [IT Support](https://noble-it.co.uk/blog/tag/it-support) [Professional Services](https://noble-it.co.uk/blog/tag/professional-services) [**Read more  »**](https://noble-it.co.uk/blog/business-phone-systems-guide) [![How to Avoid Phishing: A Guide for Small Business Teams](https://noble-it.co.uk/hubfs/how-avoid-phishing-guide-uk-businesses-noble-it.jpg)](https://noble-it.co.uk/blog/avoid-phishing-guide-uk-businesses) #### [How to Avoid Phishing: A Guide for Small Business Teams](https://noble-it.co.uk/blog/avoid-phishing-guide-uk-businesses) [Adam Nichols](https://noble-it.co.uk/blog/author/adam-nichols) : Oct 05, 2026 How to avoid phishing, from spotting fake emails and texts to MFA, staff training and what to do if you've clicked. Practical steps for UK businesses. [Cyber Security](https://noble-it.co.uk/blog/tag/cyber-security) [**Read more  »**](https://noble-it.co.uk/blog/avoid-phishing-guide-uk-businesses) [![Staying Ahead of the Curve: Essential Cybersecurity Tips for Businesses](https://noble-it.co.uk/hubfs/New_Homepage/CyberSecurity.png)](https://noble-it.co.uk/blog/staying-ahead-of-the-curve-essential-cybersecurity-tips-for-businesses) #### [Staying Ahead of the Curve: Essential Cybersecurity Tips for Businesses](https://noble-it.co.uk/blog/staying-ahead-of-the-curve-essential-cybersecurity-tips-for-businesses) [Adam Nichols](https://noble-it.co.uk/blog/author/adam-nichols) : Feb 09, 2025 Is your business prepared for the growing cyber threat landscape? Learn about the latest cyberattacks like phishing, ransomware, and social... [Cyber Security](https://noble-it.co.uk/blog/tag/cyber-security) [Professional Services](https://noble-it.co.uk/blog/tag/professional-services) [**Read more  »**](https://noble-it.co.uk/blog/staying-ahead-of-the-curve-essential-cybersecurity-tips-for-businesses) Company Company - [About Us](https://noble-it.co.uk/about-us) - [Contact](https://noble-it.co.uk/contact) Services Services - [IT Support](https://noble-it.co.uk/services/it-support) - [Cyber Security](https://noble-it.co.uk/services/cyber-security) - [IT Management & Consulting](https://noble-it.co.uk/services/it-management-and-consulting) - [Tier 4 Service Escalation](https://noble-it.co.uk/services/tier-4-service-escalation) - [Unified Communications & Connectivity](https://noble-it.co.uk/services/unified-communications-and-connectivity) - [Disaster Recovery & Business Continuity](https://noble-it.co.uk/services/disaster-recovery-and-business-continuity) Resources Resources - [Blog](https://noble-it.co.uk/blog) - [Book 360 Review](https://noble-it.co.uk/book-360-review) Sign up for our Blog Sign up for our Blog [![Noble it\_Icon\_Black-1](https://noble-it.co.uk/hubfs/Noble%20it_Icon_Black-1.png)](https://noble-it.co.uk) - [Legal Notice](https://noble-it.co.uk/legal-notice) - [Privacy Policy](https://noble-it.co.uk/privacy-policy) - [Cookie Policy](https://noble-it.co.uk/cookie-policy) - Cookies © 2026 Noble IT [Linkedin](https://uk.linkedin.com/company/nobleits) Return to top ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Adam Nichols", "url" : "https://noble-it.co.uk/blog/author/adam-nichols" }, "dateModified" : "2026-11-05T10:58:13.984Z", "datePublished" : "2026-11-05T10:57:23.000Z", "headline" : "Do You Need a Cyber Security Policy?", "image" : [ "https://noble-it.co.uk/hubfs/do-you-need-cyber-security-policy-noble-it.jpg" ], "mainEntityOfPage" : { "@id" : "https://noble-it.co.uk/blog/do-you-need-cyber-security-policy", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://noble-it.co.uk/hubfs/Noble%20it_Black_Green.png" }, "name" : "Noble IT" } } ```