The written policies every small business needs come to roughly eight documents, not forty. You need an information security policy, acceptable use, access control, data retention and deletion, incident response, vendor management, business continuity, and a code of...
An incident response plan is a short document that says who to call, who decides, and what gets done in the first hour when something goes wrong. For most small and mid-sized businesses the useful version is one page of roles and phone numbers plus three or four short...
A risk register is a single list of the things that could damage your business, each one scored, assigned to a named owner, and given a review date. If you want to know how to build a risk register, the short version is this: list what could go wrong, rate how likely...