Cybersecurity is usually treated as an IT problem. In practice, most incidents begin with an ordinary employee action.
A malicious link gets clicked, a password reused, a confidential file sent through an unsecured channel, a fraudulent payment approved. Any one of these can cost a business money, data, customers and reputation.
That is why every organisation needs a cybersecurity policy. It is also why having one is not the same as having one people follow.
A thirty-page document full of technical language looks impressive in an audit. It provides very little protection if staff do not understand it, cannot remember it, and have no idea what to do when something actually happens.
There is a legal dimension too. Under the Nigeria Data Protection Act 2023, organisations processing personal data carry accountability obligations enforced by the Nigeria Data Protection Commission, with additional requirements for those designated data controllers of major importance. A documented, working security policy is part of demonstrating that accountability.
The goal is not to produce a policy. It is to produce one that fits the way your people actually work.
The short version
- Start from the risks your business actually faces, not a template you found online.
- Write it in plain language. If a new employee cannot follow it after one read, rewrite it.
- Give staff one repeatable process for suspicious messages: STOP → CHECK → VERIFY → REPORT.
- Make reporting mistakes safe — but still define what deliberate breaches cost.
- Provide the tools the policy assumes. A rule you have not enabled is not a rule.
- Train with real scenarios, test with simulations, and measure whether any of it is working.
Start With the Risks Your Business Faces
Before writing anything, work out what could realistically hurt this business. A bank and a ten-person consulting firm do not face the same threats, and they should not have the same policy.
Ask:
- What sensitive information do we actually hold?
- Who has access to financial systems and bank details?
- How are payments and transfers currently approved?
- Which systems would stop the business if they went down tomorrow?
- How are staff accessing company systems remotely?
- What happens today if someone loses a laptop or phone?
- How often do staff receive suspicious emails and WhatsApp messages?
- Who can see confidential customer or employee records?
For most Nigerian SMEs the honest answer concentrates around a short list: phishing and business email compromise, fraudulent payment and bank-detail instructions, WhatsApp and social account takeover, weak or reused passwords, lost devices, and staff putting confidential data into unapproved apps and AI tools.
Write the policy against that. Copying a generic template and changing the company name produces a document that addresses somebody else’s risks.
Keep the Policy Simple
Complexity is the main reason policies get ignored. If someone has to read several pages of technical explanation before understanding what is expected of them, the policy has already failed.
Instead of writing:
| “Personnel shall implement appropriate authentication mechanisms in accordance with organisational access-control requirements.” |
Write:
| “Use multi-factor authentication on all company accounts where it is available.” |
Instead of explaining what phishing is, tell people exactly what to do:
| “If you receive a suspicious email, do not click the link or open the attachment. Report it to the security contact of the organisation.” |
After one read, staff should be able to answer three questions: What am I expected to do? What am I not allowed to do? What do I do if something goes wrong?
If they cannot, the policy is too long or too abstract.
Explain the “why”, briefly
People follow rules they understand. “Do not share your password” is an instruction. “Your password is how the system knows an action was yours — sharing it means we cannot tell who did what, and one stolen password can open several systems” is a reason.
One sentence of explanation per rule is enough. The point is that the policy exists to protect the business, its customers and the employee’s own work — not to make anyone’s day harder.
Focus on Behaviour, Not Technology
A policy should not read like an IT manual. Staff need rules they can apply to what they do all day.
Passwords
Use a strong, unique password for every company account. Never share a password with a colleague, a manager or IT.
Multi-factor authentication
Enable MFA on every company account that supports it. Never approve an MFA prompt you did not personally trigger — deny it and report it.
Email and messaging
Verify unexpected links, attachments and requests for sensitive information before acting on them. This applies to WhatsApp and social media as much as to email.
Devices
Protect company devices with a password or biometric lock. Do not leave them unattended in public. Report a loss the same hour, not the next working day.
Data
Store and share confidential business information only through approved systems.
Software and AI tools
Do not install unapproved applications. Do not enter customer personal data, bank details, staff records or confidential contracts into any external AI tool, and check AI-generated output before it reaches a customer. Our insight AI for SMEs, Where to Actually Start covers this in more detail.
Public Wi-Fi
Avoid reaching sensitive company systems over unsecured public networks unless the appropriate controls are in place.
Short rules are easier to understand, easier to remember and easier to enforce.
Give Staff One Process: STOP → CHECK → VERIFY → REPORT
Rules tell people what to do in general. A process tells them what to do in the moment, which is when it matters.
Whenever a message asks for money, credentials, sensitive information or urgent action:
| Step | What it means in practice |
| STOP | Do not click, reply, download or pay. Urgency is the attacker’s main tool — treat it as a warning sign, not a reason to hurry. |
| CHECK | Look at the real sender address, not the display name. Does this request fit the person’s normal behaviour and this supplier’s normal process? |
| VERIFY | Confirm through a different channel — a phone number already held on file, never one supplied in the message itself. |
| REPORT | Tell [SECURITY CONTACT], even if it turns out to be nothing. Reporting a false alarm costs a minute. |
Four words, one process, every suspicious message. Print it and put it at every desk. For a small business this is the single most useful thing you can give your staff.
Make Payment Verification a Specific Rule
Criminals rarely need to break into a banking system. They persuade an employee to send money to the wrong account, usually by impersonating a director, a supplier or a finance colleague.
The rule belongs in the policy, stated so plainly it cannot be misread:
| Any request to make a payment or change a beneficiary’s bank details must be independently verified through an approved channel before the transaction is processed — including when it appears to come from a director. |
Then add the sentence that makes it work: no employee will ever be penalised for delaying a payment in order to verify it. Most of these frauds succeed because somebody junior was afraid to question somebody senior.
Our insight on Cybersecurity mistakes Nigerian SMEs make explains why these losses are so hard to recover once the transfer has gone through.
Define Who Is Responsible for What
Policies fail when responsibility is vague. Two things need to be written down: who does what, and who to call.
The split:
| Who | Responsible for |
| All staff | Following the policy and reporting anything suspicious immediately |
| Managers | Reinforcing the policy, modelling it personally, confirming their teams comply |
| IT or security | Technical controls, access management, monitoring, backups, incident response |
| Management | Approving the policy, funding the tools, and complying with it visibly |
| HR | Security in onboarding, training records and same-day offboarding |
Then name actual people for the operational questions: who to contact about a suspected phishing attack, who approves access to sensitive systems, who can disable a compromised account, and who speaks to customers or regulators if it comes to that.
No employee should ever have to wonder who to tell when they think they have been hacked. That answer should take them under five seconds to find.
Make Incident Reporting Easy — and Safe
People will make mistakes. What matters is what happens in the next ten minutes.
The worst policy is one that makes staff afraid to speak up. An employee clicks a link, realises something is wrong, and expects to be punished for admitting it — so they close the window and say nothing. The attacker now has hours instead of minutes.
Put the process in writing:
| If you suspect your account, device or information has been compromised, report it immediately to the security contact of the company. Do not attempt to hide the incident or investigate beyond your level of responsibility. |
And commit, in writing, that prompt good-faith reporting will not be punished — including when the person reporting caused the problem. A contained incident and a catastrophic one are frequently the same incident, reported at different speeds.
Define Consequences — and Keep Them Proportionate
Safe reporting does not mean nothing carries consequences. Staff need to know the rules have weight, and the policy should say what happens when they are deliberately broken.
Distinguish three things:
- Honest mistakes, promptly reported — handled with support and training, not discipline.
- Repeated carelessness after warning — handled as a performance matter.
- Deliberate breaches — sharing credentials after warning, bypassing controls, misusing company data — handled under the disciplinary procedure, and reported to law enforcement where a crime may have occurred.
Treating the first and third identically guarantees that nobody in the first category ever reports again. Align the wording with your existing HR disciplinary procedure before issuing.
Don’t Make Security the Enemy of Productivity
Controls that make work harder get bypassed. Force people to memorise complex passwords and change them constantly, and they will write them down or reuse them — which is worse than where you started.
Design the controls around how people actually work. For a business already on Microsoft 365 or Google Workspace, most of this is configuration rather than new spending:
| What the policy requires | What delivers it |
| MFA, single sign-on and access control | Microsoft Entra ID Conditional Access; Google Workspace 2-Step Verification enforcement |
| Endpoint protection and device encryption | Microsoft Defender for Business; Intune with BitLocker policy |
| Email security and anti-impersonation | Microsoft Defender for Office 365; SPF, DKIM and DMARC records |
| Secure storage and controlled sharing | SharePoint and OneDrive with sensitivity labels; Google Drive shared drives |
| Data-loss prevention | Microsoft Purview DLP; Google Workspace DLP rules |
| Automatic software updates | Microsoft Intune update rings; Windows Autopatch on eligible licences |
| Password management | A centrally deployed password manager, rolled out for staff rather than left to them |
| Security awareness training | Attack simulation training in Microsoft 365; short recurring internal sessions |
Most Nigerian SMEs already pay for more of this than they have switched on. The principle underneath all of it: make the secure option the easy option.
Train With Real Examples
Emailing the policy and collecting signatures is not training. People remember situations, not clauses.
Rather than telling staff to beware of phishing, put them in the moment:
| Scenario: An email that appears to come from the Managing Director asks you to urgently buy gift cards. What should you do? Do not act on it. Verify independently through an approved channel. |
| Scenario: A supplier emails to say their bank account has changed and asks you to use the new account for today’s payment. What should you do? Follow the bank-detail-change verification procedure before paying anything. |
| Scenario: A colleague asks you to paste the customer list into a free AI tool to draft follow-up messages faster. What should you do? Decline, and use an approved tool. Customer personal data must not go into unapproved platforms. |
Keep sessions short and frequent rather than annual. Threats change, tactics change, and people forget.
Test It, Then Measure Whether It Is Working
Signatures prove distribution, not comprehension. Run authorised phishing simulations and tabletop exercises — a good one here is a simulated WhatsApp message from the CEO requesting an urgent transfer to a new account.
The objective is never to embarrass anyone. If many people fall for the same simulated attack, that is useful management information about where training or technical controls need strengthening.
Then track whether the policy is changing anything:
- Phishing simulation results over time
- Number of suspicious messages reported by staff
- Number and severity of actual security incidents
- MFA adoption across accounts
- Security training completion
- Average time between an incident occurring and being reported
- Unauthorised software and AI tool installations
- Repeat policy violations
Read them carefully. A rise in reported suspicious activity looks negative and usually is not — it generally means staff have become comfortable reporting. Silence is the metric to worry about.
Apply the Rules Consistently
A policy loses credibility the moment staff see someone exempt from it.
Security policies must apply consistently across the organisation, regardless of an employee’s position. If multi-factor authentication (MFA) is mandatory, executives should not be exempt simply because they find it inconvenient. If password sharing is prohibited, managers must follow the same rule. Likewise, payment instructions should always go through the required verification process, regardless of who made the request.
Rules should vary by role and risk, never by seniority. Leadership behaviour is not adjacent to security culture — it is security culture.
Review It Regularly
A policy written three years ago does not describe how your business works today. Review it at least annually, and immediately after any significant incident or change in operations.
Things that typically trigger a rewrite:
- Remote and hybrid working arrangements
- New cloud applications
- Mobile devices and BYOD
- Artificial intelligence tools entering everyday workflows
- New payment fraud techniques
- Changes in data-protection requirements
- Changes to your technology infrastructure
An Eleven-Section Framework for Your Policy
A workable SME policy needs eleven sections and nothing more:
- Purpose — why the policy exists, including NDPA accountability.
- Scope — who and what it covers, including contractors and personal devices.
- Passwords and Authentication — password and MFA requirements.
- Email and Messaging — phishing, links, attachments, WhatsApp.
- Payments and Financial Requests — the mandatory verification procedure.
- Devices — laptops, phones, encryption, loss reporting.
- Data Protection — how customer and confidential information is handled.
- Software and AI Tools — approved applications, and what must never be entered into external AI platforms.
- Incident Reporting — exactly who to contact and what to do.
- Enforcement — proportionate consequences.
- Review — when the policy is revisited and by whom.
Our free template follows this structure with guidance notes in every section, a printable STOP → CHECK → VERIFY → REPORT desk card and an employee acknowledgement form.
The Golden Rule: Don’t Make Employees Guess
Nobody facing a suspicious message should have to search a forty-page document to work out what to do.
| If an employee… | They should… |
| Receives an unusual payment or bank-detail request | Verify it by phone before acting |
| Clicks a suspicious link | Report it immediately, without fear |
| Loses a company device | Report it the same hour |
| Receives an unexpected attachment | Leave it unopened until verified |
| Needs access to sensitive information | Use the approved access request process |
| Wants to use a new app or AI tool for work | Get approval first |
| Gets an MFA prompt they did not trigger | Deny it and report it |
| Is unsure about anything | Ask before acting |
Print it. Put it at every desk. Simple rules are easier to remember and easier to enforce.
The Bottom Line
A cybersecurity policy should not be a document that sits in a handbook and is forgotten after onboarding. It is a framework for making safer decisions on an ordinary Tuesday.
The policies that work are clear, realistic, enforceable and regularly reinforced — and backed by tools that make compliance the path of least resistance.
Your staff do not need to become security experts. They need to recognise the risks they will actually meet, know what is expected of them, and have a simple way to get help when something goes wrong.
Cybersecurity is not only firewalls and antivirus. It is people making the right decision at the right moment. Build the policy around those decisions and you have a reasonable chance of one that gets followed.
Frequently Asked Questions
What should a small business cybersecurity policy include?
Eleven sections cover it: purpose, scope, passwords and authentication, email and messaging, payments and financial requests, devices, data protection, software and AI tools, incident reporting, enforcement, and review. Anything beyond that belongs in supporting procedures rather than the policy itself.
How long should a cybersecurity policy be?
Short enough that staff read it and remember it — for most SMEs a handful of pages built around a small number of core behaviours. Detailed technical requirements belong in separate procedure documents.
Is a cybersecurity policy required by law in Nigeria?
The Nigeria Data Protection Act 2023 places accountability obligations on organisations that process personal data, with additional requirements for organisations designated as data controllers of major importance. A documented security policy forms part of demonstrating that accountability. Confirm current thresholds with the NDPC.
How often should we update our cybersecurity policy?
At least annually, and immediately after any security incident, significant change in systems, or the introduction of new tools such as AI platforms.
How do we get employees to actually follow the policy?
Keep it short and in plain language, give staff the tools it assumes, make reporting mistakes safe, apply it consistently to management, train briefly and often with real scenarios, and test it with simulations rather than relying on signatures.
Should our policy cover AI tools like ChatGPT and Copilot?
Yes. Name the approved tools, state clearly what must never be entered into any external AI platform — customer personal data, bank details, staff records, confidential contracts — and require human review of AI-generated output before it reaches a customer or regulator.
