IT Security Policy: Template for Small and Medium-Sized Businesses

The IT security policy is the top-level document of information security. The BSI calls it the information security guideline, in English the Information Security Policy (BSI Standard 200-1, chapter 7.1); Implementing Regulation (EU) 2024/2690 refers to the policy on the security of network and information systems (Annex point 1.1). It describes in generally understandable terms for which purposes, and with which means and structures, information security is to be achieved, and it contains security objectives and strategy (BSI Standard 200-2, chapter 3.4). It is management's visible commitment to its strategy (BSI Standard 200-1, chapter 3.1).

Structure of this template: Part A is the policy that management approves. Part B contains basic rules for all employees, as the BSI envisages for a guideline on secure IT use: objectives, roles, contact person, and measures to be observed (ORP.1.A16). TOMORIS recommends this separation so that the policy stays short and the basic rules are easier to adapt.

Minimum content is specified in BSI Standard 200-2 (chapter 3.4.3) and requirement ISMS.1.A3 of the IT-Grundschutz Compendium. For essential and important entities, the content under Annex point 1.1.1(a) to (k) of Implementing Regulation (EU) 2024/2690 is binding. The regulation specifies Art. 21(2)(a) of the NIS2 Directive and applies directly to providers such as cloud and managed services, and via § 2 NISV 2026 to all other essential and important entities. Where the BSI does not require an item for the policy itself, the table gives the related requirement in parentheses.

Since October 1, 2026, the NISG 2026 has applied to essential and important entities (BGBl. I No. 94/2025, § 51 para. 2). Their management bodies, meaning the persons or bodies appointed by law, articles of association, or contract to manage the business (§ 3 no. 11), must ensure and oversee compliance with the risk management measures under § 32 (§ 31 para. 1). They must attend cybersecurity training designed for them; employees must be offered corresponding training regularly (§ 31 para. 2). The minimum content of risk management includes policies on risk analysis and information system security (§ 32 para. 4 lit. a).

On October 1, 2026, the NISV 2026 was promulgated (BGBl. II No. 290/2026); it entered into force at the end of that day (§ 9). Its § 2 declares the requirements of Implementing Regulation (EU) 2024/2690, including its annex, applicable to the other types of essential and important entities in Annexes 1 and 2 of the NISG 2026 as well. For the policy, this means: content under Annex point 1.1.1, the date of formal approval by the management bodies (lit. k), review by them at least annually and after significant incidents or significant changes with a documented result (point 1.1.2), and at least one person who reports directly to the management bodies (point 1.2.3).

If an entity cannot meet individual requirements temporarily or because of its size, it implements compensating measures, documents them with reasons, and reviews their effectiveness at least annually; this does not apply to requirements that only apply to the extent appropriate, applicable, or feasible (§ 4 NISV 2026). Anyone who breaches the training obligations commits an administrative offense; the same applies to anyone who fails to implement risk management measures, unless the authority learned of this only through the self-declaration (§ 45 para. 1 no. 1 to 3). The penalty range is up to €10 million or 2% of worldwide annual turnover in the previous year for essential entities, and up to €7 million or 1.4% for important entities, whichever is higher in each case (§ 45 para. 2 and 3).

The NIS2 Directive requires management bodies to approve the measures, oversee their implementation, and be held accountable (Art. 20(1)); in Austria, the wording of § 31 NISG 2026 is authoritative. Whether your company is affected is governed by §§ 24 to 26 together with Annexes 1 and 2. For all others, the content of this template consists of recommendations based on the BSI.

Replace every placeholder in square brackets, delete anything that does not apply, and derive the objectives from your business objectives and your risk analysis. The eight sections cover all rows of the table in Section 2; NIS2 entities should not delete anything there without review.

1. 1

   Purpose and scope

   This policy defines why and how [Company] protects information. It applies to [the entire company | sites, divisions], to management, managers, and all employees, to external persons working for [Company], and to information in any form: on paper, in IT systems, in cloud services, and on mobile devices.

2. 2

   Importance and security objectives

   Our most important business processes are [e.g., order processing, production]; they depend on [e.g., ERP system, email]. An outage or leak of this information endangers [e.g., ability to deliver, customer trust]. We therefore protect confidentiality, integrity, and availability as appropriate to the risk. Our objectives: [e.g., customer data is accessible only to authorized persons; order processing is running again within [hours] after an outage; legal and contractual obligations are met].

3. 3

   Responsibility of management

   Management bears overall responsibility for information security. It approves this policy, enforces it, leads by example in following the rules, and provides staff, budget, procedures, and technology. It receives reports on status, risks, and incidents at least [every six months] and decides how to handle residual risks.

4. 4

   Roles and organization

   The information security officer is [name, function], deputy [name, function]. The information security officer coordinates information security, advises management, reports directly to it, and is involved early in major projects and new IT systems. Further roles are listed in the table below; management reviews them [annually] and after significant incidents or changes.

5. 5

   Policies and training

   The security concept defines the measures based on a risk analysis. Individual topics are governed by separate policies consistent with this policy: [e.g., basic rules (Part B), access control, backup, security incidents, suppliers], approved by [function]. All employees are briefed before their first IT use and trained at least [annually]; management receives training designed specifically for it.

6. 6

   Violations and exceptions

   Violations can harm [Company], customers, and partners; employees are informed of possible consequences. [Function] decides case by case how a violation is handled, in accordance with the employment contract, [works agreement], and applicable law. Exceptions to rules are permitted only with justification, for a limited time, and after approval by [function]; [information security officer] keeps an overview of them.

7. 7

   Review, metrics, and documentation

   We continuously improve information security. Management reviews this policy at least [annually] and after significant incidents or significant changes, and documents the result. We measure progress by [metrics, e.g., training rate, time to install critical updates]. [information security officer] retains [documents, e.g., risk analysis, reports, training records, incident logs] for [period].

8. 8

   Entry into force

   Management approved this policy on [MM/DD/YYYY]. It enters into force on [MM/DD/YYYY], replaces [previous version | none], and is communicated to all employees and the affected external partners, who confirm that they have read it. Next review no later than [MM/DD/YYYY].

References for the model text: Section 3 based on ISMS.1.A1 and ISMS.1.A12. Section 4 based on ISMS.1.A4, ISMS.1.A6, and Annex point 1.2 IR 2024/2690. Section 5 based on ISMS.1.A7 and ORP.3.A3. Section 6 based on ISMS.1.A8 and ORP.5.A5. Section 7 based on ISMS.1.A11, ISMS.1.A13, and Annex points 1.1.1(d), (h), (j), and 1.1.2. Section 8 based on BSI Standard 200-2, chapter 3.4.4, and Annex point 1.1.1(f), (k).

Acknowledgment: I have read the basic rules and will comply with them. I will direct questions to [contact person, contact details]. New employees confirm before their first IT use; all users confirm again regularly or after major changes (ORP.1.A16). The “Basis” references can be omitted in your version.

• Management has commissioned the work and appointed an information security officer with adequate resources (BSI Standard 200-2, chapter 3.4; ISMS.1.A4).
• If the role cannot be filled internally, an external information security officer has been engaged; the contract governs tasks, rights, obligations, confidentiality, and the handover at the end (ISMS.1.A5; BSI Standard 200-2, chapter 4.11).
• IT operations, business units, data protection, HR, and employee representatives have contributed to the draft (BSI Standard 200-2, chapter 3.4.1).
• The scope fully covers the business processes under consideration (BSI Standard 200-2, chapter 3.4.3).
• All placeholders are replaced; the objectives are derived from business objectives, laws, customer contracts, and threats (BSI Standard 200-1, chapter 7.1).
• NIS2 entities: the risk analysis takes technological, human, supply chain, and location-related risks into account (§ 3 NISV 2026); compensating measures are documented with reasons (§ 4).
• The information security officer reports directly to management, has a deputy, and is not also an active administrator (ISMS.1.A4, ISMS.1.A6; BSI Standard 200-2, chapter 4.4).
• Management has given formal written approval, and the approval date is in the document (BSI Standard 200-2, chapter 3.4.4; Annex point 1.1.1(k) IR 2024/2690).
• The policy has been communicated to everyone and is easily accessible; it is explained to new employees before their first IT access (BSI Standard 200-2, chapter 3.4.4).
• The basic rules are confirmed in writing; everyone knows the contact person and the reporting channel for incidents (ORP.1.A15, ORP.1.A16, DER.2.1.A3).
• Training for management and employees is scheduled (ORP.3.A4; for NIS2 entities § 31 para. 2 NISG 2026).
• The next review date is set: according to the BSI, after two years at the latest (BSI Standard 200-2, chapter 3.4.5), and for NIS2 entities at least annually (Annex point 1.1.2 IR 2024/2690).

This checklist is a TOMORIS recommendation based on BSI Standard 200-2. For essential and important entities, §§ 31 and 32 NISG 2026 and the requirements of Implementing Regulation (EU) 2024/2690, which § 2 NISV 2026 declares applicable, are mandatory by law.

• Too long and too technical: according to the BSI, more than 20 pages has not proven effective (BSI Standard 200-2, chapter 3.4.3). Specific measures belong in the security concept (ISMS.1.A10).
• An active administrator as information security officer, or the role in the IT department: the BSI advises against this because of the risk of role and interest conflicts (BSI Standard 200-2, chapter 4.4).
• Signed but not communicated: all employees should know the content, new employees before their first IT access (BSI Standard 200-2, chapter 3.4.4).
• No deputy: there must be effective deputy arrangements for all important functions of the security organization (ISMS.1.A6).
• No resources: resources must be planned so that the agreed security level can actually be achieved (BSI Standard 200-1, chapter 7.2).
• Adopted once, never reviewed: NIS2 entities must review at least annually and document the result (Annex point 1.1.2 IR 2024/2690).
• Template adopted unchanged: objectives with no connection to your own company do not meet ISMS.1.A3, because the policy must explain how the security objectives relate to the business objectives.

The policy is followed by the security concept: it derives specific measures from the security objectives, protection requirements, and risk assessment (ISMS.1.A10). Plan it together with the policy.