In this article
Most security incidents at an SME are not born from a sophisticated attack, but from something that seemed normal: the same password for email and the courier's website, the "invoice" opened as an attachment, the USB stick brought from home, the password lent to the new colleague "just for today". Without written rules, nobody did anything wrong. Managed cybersecurity starts with seven short policies — one sheet each — that everyone has read and signed.
The seven policies at a glance
| Policy | Question it answers |
|---|---|
| Passwords and MFA | How are accounts protected? |
| Devices | Which devices access the data, and how? |
| Email and communications | What do we do with a suspicious email? |
| Access | Who sees what? |
| Backups | What is copied, where to, and how is it tested? |
| Incident response | What if it happens? |
| Joiners and leavers | What changes when someone arrives or leaves? |
Protecting accounts: passwords and authentication
- Long passphrases 14 or more characters, instead of short combinations with symbols.
- One per service Stored in the company password manager, never sent by email or message.
- Mandatory MFA On email, files and any remote access, with no exception for management, who are the favourite target.
- Shared accounts The password changes whenever someone leaves.
We explain the why and the how in password managers for business.
Controlling devices: device policy
Company devices have protection installed, automatic updates and an encrypted disk. Personal devices access email and files through the browser, without downloading to the disk. Laptops are not left in the car, and a loss or theft is reported the same day so access can be blocked remotely. Only software from the approved list is installed — and that list exists.
Stopping fraud: email and communications
A suspicious email is forwarded to the IT team; nobody replies or clicks. Any request to change a supplier's IBAN is confirmed by telephone, to a number already known, never the one in the email. This is the most effective defence against altered invoice fraud. Client data does not travel by personal email or messaging apps.
Limiting permissions: access policy
- Minimum access Each person sees only what their role requires.
- Six-monthly review Permissions on shared folders and SharePoint reviewed twice a year.
- Restricted administration Administrator rights only for the IT team.
- Controlled suppliers Individual, temporary and logged access.
- Change of role Old access is removed, not just new access added.
This is the principle of least privilege put into practice, as we explain in Zero Trust in 4 steps for SMEs.
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
Ensuring recovery: backups
The policy defines what is copied, how often, where to and for how long. At least one copy is kept off-site and is immutable, to withstand ransomware. Restore tests have a set date and a recorded result, and it is defined who receives failure alerts and how quickly they deal with them. See how managed backup works and what a disaster recovery and business continuity plan adds.
Preparing for the worst day: incident response
One page that answers "what if it happens?":
- Who alerts whom — and in what order.
- What is isolated first — the affected workstation, not the whole server.
- Who communicates — with clients and suppliers, and who does not speak.
- Mandatory notifications — to the CNPD (Portugal's data protection authority) within 72 hours when personal data is involved; to the National Cybersecurity Centre for entities covered by NIS2.
- Contacts on paper — for the IT supplier and the insurer, because on the day of the incident email may be down.
The four phases of a cyberattack help show where each action fits.
Closing doors: people joining and leaving
Joining: an account with the role's permissions, MFA on day one, equipment handed over and logged, and a 30-minute introduction to these policies. Leaving: account disabled on the last day, not the following week; email forwarding set up; equipment returned and checked; shared passwords changed; supplier access in that person's name revoked. Active accounts belonging to former employees are among the failings we find most often in audits.
From document to practice
Each policy fits on half a page. Start from what the company already does well, add what is missing and avoid bans nobody will follow — one ignored rule weakens all the others. Approve with management, present in a short session, collect signatures and review once a year.
Under DataRoad's managed cybersecurity contracts we provide templates of these seven policies adapted to the company and check, in the monthly report, what is being complied with technically: MFA active, accounts disabled, backups tested. In 11 years, DataRoad has never suffered a security incident.
Frequently asked questions
Does a 12-person company really need written policies?
It needs the same seven, just shorter. The risks are the same; only the number of people reading them changes. In a small company, a forgotten account belonging to someone who has left weighs even more.
Do these policies comply with GDPR and NIS2?
They form part of the technical and organisational measures both require. They do not replace the GDPR record of processing activities or the NIS2 risk analysis, but they are the foundation of those documents.
Who signs?
Everyone who accesses systems, including interns, temporary staff and management. The signature is what makes it possible to require compliance.
When are they reviewed?
Once a year and whenever there is a significant change: new management software, widespread remote working, an incident or a change in the law.
Next step: the seven policies adapted to your company
We provide the templates, adjust them to your situation and configure the technical side — MFA, access, backups — so the paper matches practice. Discover DataRoad managed cybersecurity and ask for a no-obligation proposal.
More than 10 workstations · support contract · remote, on-site and telephone support. Call +351 211 459 950* or write to sales@dataroad.pt.
*Call to a Portuguese landline.
