The written policies every small business needs come to roughly eight documents, not forty. You need an information security policy, acceptable use, access control, data retention and deletion, incident response, vendor management, business continuity, and a code of...