Free Security Policy Templates: 8 Ungated Policies for US Small Businesses (2026)

Updated November 5, 2026. Rule text quoted from the eCFR and the HIPAA Security Rule, linked in Sources.

The short answer: most US small businesses need eight written security policies to cover what federal rules and cyber insurers ask for: an information security program policy, acceptable use, passwords and multi-factor authentication, access control, payment and request verification, remote work and devices, incident response, and security awareness training. All eight are below, free and ungated. Copy them from this page or download the Word pack, replace "Your Company" with your business name, and name an owner.

No form, no email, no sales call. These templates are a starting point, not legal advice: have your counsel or compliance lead confirm they meet the rules that apply to you.

Do US rules require written security policies?

Yes, for many businesses. The FTC Safeguards Rule, which covers tax preparers, auto dealers, mortgage brokers and other non-bank financial businesses, requires an information security program "written in one or more readily accessible parts," a designated qualified individual to oversee it, and a written incident response plan. Businesses with customer information on fewer than 5,000 consumers are exempt from a few parts, including the written incident response plan and the annual board report, but not from the written program itself.

The HIPAA Security Rule requires covered entities and business associates to keep their security policies and procedures "in written (which may be electronic) form," to retain that documentation for 6 years, and to review it periodically. Even where no rule applies, the FTC's small business guidance is direct: "Have policies in place that cover basic cybersecurity." Cyber insurers ask the same question on applications, and a written policy set is the evidence they expect to see.

What's in the free security policy template pack

• Information security program policy: who owns security, how exceptions are approved, and when the program is reviewed.
• Acceptable use policy: ground rules for company devices, accounts, data and AI tools.
• Password and multi-factor authentication policy: MFA everywhere, a password manager, no shared codes.
• Access control and offboarding policy: least privilege, separate admin accounts, same-day removal when someone leaves.
• Payment and request verification policy: a callback rule for wires, gift cards and bank-detail changes.
• Remote work and device policy: encryption, screen locks, updates and lost-device reporting.
• Incident response policy: who to call, what to log and how to learn from each incident.
• Security awareness training policy: onboarding training, monthly phishing simulations and private coaching after a click.

How to use these templates

1. Replace "Your Company" with your business name and "the Security Lead" with the person who owns security, by name and title.
2. Fill in an owner, effective date and next review date for each policy. The Word pack has a box for each.
3. Have every employee read and sign the acknowledgment page, and keep the dated record.
4. Review the set at least once a year and after any incident or major change, and keep prior versions. HIPAA requires 6 years of retention.

The 8 security policy templates

1. Information security program policy

Why you need it: the FTC Safeguards Rule requires a written information security program and a named qualified individual who oversees it (16 CFR 314.3(a) and 314.4(a)).

• Your Company maintains a written information security program made up of the policies in this pack.
• The Security Lead (name and title) oversees the program, enforces these policies and approves any exception in writing.
• The Security Lead reviews the program at least once a year and after any significant security event or business change.
• The Security Lead reports in writing on the state of the program at least once a year to the owner or board.
• Each policy lists its owner, effective date and next review date.

2. Acceptable use policy

Why you need it: it sets the ground rules for company devices, accounts and data, and it is the first policy cyber insurers and auditors ask to see.

• Company devices, accounts and data are for business use. Limited personal use is fine when it does not conflict with this policy.
• Employees install only software approved by the Security Lead or the IT provider.
• Employees do not share accounts, and do not store company data in personal email, personal cloud storage or unapproved AI tools.
• Employees do not disable security software, updates or device encryption.
• Your Company may monitor company systems for security purposes, as permitted by law.

3. Password and multi-factor authentication policy

Why you need it: the FTC Safeguards Rule requires multi-factor authentication for anyone accessing an information system unless the qualified individual approves an exception in writing (16 CFR 314.4(c)(5)).

• Every account that reaches company data uses multi-factor authentication. Exceptions need written approval from the Security Lead.
• Passwords are at least 14 characters, unique to each account and stored in the company password manager. Long passphrases are encouraged.
• Employees never share passwords or MFA codes, including with anyone who claims to be IT support.
• A password is changed immediately if there is any sign the account was exposed.

4. Access control and offboarding policy

Why you need it: the Safeguards Rule requires access controls that are implemented and periodically reviewed (16 CFR 314.4(c)(1)), and HIPAA expects the same discipline for patient data.

• Employees get only the access their role needs.
• Admin accounts are separate from everyday accounts and are used only for admin work.
• Managers request access changes in writing, and the Security Lead or IT provider records each change.
• The Security Lead reviews who has access to what at least twice a year.
• When an employee leaves, all access is removed on their last day and company devices are returned.

5. Payment and request verification policy

Why you need it: the FTC lists business email imposters among the most common attacks on small businesses. A written callback rule stops most of them before money moves.

• Any request to send money, buy gift cards, change bank or payroll details, or share sensitive data is verified by calling the requester at a phone number already on file, never one in the message.
• Urgency, secrecy or pressure in a request is a reason to slow down and verify, not a reason to skip steps.
• A second person approves payments above an amount Your Company sets.
• Employees report suspicious messages with the report button or to the Security Lead. Reporting is always welcome, even after a click.

6. Remote work and device policy

Why you need it: the Safeguards Rule requires encryption of customer information in transit over external networks and at rest (16 CFR 314.4(c)(3)), and most of that data now lives on laptops and phones.

• Company laptops and phones use full-disk encryption, a screen lock and automatic updates.
• Personal devices reach company email or files only when enrolled in device management or approved by the Security Lead.
• Employees avoid public Wi-Fi for company work unless connected through the company VPN or a personal hotspot.
• Lost or stolen devices are reported to the Security Lead immediately.
• Company data is not copied to USB drives or personal devices without approval.

7. Incident response policy

Why you need it: the Safeguards Rule requires a written incident response plan (16 CFR 314.4(h)), and the FTC's small business guidance says plainly: have an incident response plan.

• Anyone who suspects a security incident reports it to the Security Lead right away. Nobody is punished for reporting.
• The Security Lead confirms the incident, contains it (disconnect affected devices, reset credentials) and keeps a written log of actions and times.
• Contacts are listed in advance: IT provider, cyber insurer, legal counsel and bank.
• The Security Lead decides with counsel whether customers, regulators or law enforcement must be notified.
• After every incident, the team writes down what happened and updates these policies.

8. Security awareness training policy

Why you need it: the Safeguards Rule requires security awareness training updated to reflect the risks your assessment finds (16 CFR 314.4(e)), HIPAA requires a training program for the whole workforce, and PCI DSS 12.6.3.1 expects phishing to be covered.

• Every employee, including management, completes security awareness training at onboarding and short training throughout the year.
• Your Company runs phishing simulations at least monthly so employees practice spotting manipulation in a real inbox.
• An employee who clicks a simulation gets immediate, private coaching. Results improve the program and are never used to shame or discipline individuals.
• Training content is updated whenever the risk assessment identifies a new threat.
• Completion records and simulation reports are kept as evidence for auditors and cyber insurers.

Where these templates are not enough

Eight short policies cover what most small businesses get asked for. They are not a full control framework. If you handle card data at volume, hold a defense contract that requires CMMC, or run a hospital or large practice, you need policies mapped control by control to that framework, plus the procedures and evidence behind each one. Use this pack as the plain-English layer employees actually read, and build the detailed procedures underneath it with your compliance lead.

How Hook Security helps with policy 8

Most of these policies are a one-time write-up. Policy 8 is the one that needs to run every month, and it is where most small businesses fall behind. Hook Security runs it for you: phishing simulations and short training go out on autopilot, an employee who clicks gets private coaching in the moment instead of a lecture, and dated completion and simulation reports are ready for your auditor or insurer. Hundreds of MSPs use Hook to run that program for their clients, and Hook's pricing is published.

If you are comparing options first, see our guide to the best security awareness training platforms for US businesses.

Bottom line

Write down eight policies, name an owner, get employee signatures and review them once a year. That covers the written-program expectations in the FTC Safeguards Rule and HIPAA for most small businesses, and it answers the policy questions on a cyber insurance application. Then make sure the training policy actually runs.

Frequently asked questions

Are these security policy templates really free?

Yes. All eight policies are on this page and in the Word download with no form or email required. Edit them however you like.

How many security policies does a small business need?

Most small businesses can start with eight: an information security program policy, acceptable use, passwords and MFA, access control, payment and request verification, remote work and devices, incident response, and security awareness training. Regulated businesses may need more detailed policies for their framework.

How often should security policies be reviewed?

At least once a year, and again after any security incident or major business change. HIPAA requires periodic review and keeping policy documentation for 6 years, and the FTC Safeguards Rule expects the program to be kept current with your risk assessment.

Sources

• 16 CFR 314.3, Standards for safeguarding customer information (eCFR)
• 16 CFR 314.4, Elements (eCFR)
• 16 CFR 314.6, Exceptions (eCFR)
• 45 CFR 164.316, Policies and procedures and documentation requirements (Cornell LII)
• Cybersecurity for Small Business (FTC)

Keep reading

• Best Security Awareness Training Platforms for US Businesses (2026)
• Cyber insurance evidence for security awareness training
• Should you punish employees who fail phishing simulations?
• Phishing Simulation Tools: 8 Compared (2026)
• HIPAA security awareness training
• Hook Security vs usecure