Security policies checklist

Who leads Whoever looks after digital security Name

Use it when

you're writing down what the team has agreed, or reviewing it.

The first agreements

Accounts: a password manager, two-factor everywhere, no logins passed round in chat.
Joining and leaving: what’s switched on on the first day, and off on the last.
Devices: screen locks, encryption and updates, and which devices can hold work.
Information: what’s sensitive, where it’s kept, who sees it, how long you keep it.
Which channel for what, and what goes on a trip.
The office: keys and codes, locking up, papers and visitors.
Reporting problems: how, to whom and with no blame.

Find the habits you already have. Walk through a lost phone, a leaver, a breach.
Agree a few easy things, try them, then write down the ones that work.
Say why each rule exists, and keep it short.

Keep passwords, and the names of sources and at-risk partners, out of the policy itself.

Take care: Leaders follow the agreements too, where everyone can see.

Started Done Review again