Speak directly to our team
01603 218000
Speak directly to our team
01603 218000
  • Resources
  • Cyber security procedures: helping you to...
Home
13 mins read
Guides and advice Business & Commercial Insurance Technology & Life Science

Cyber security procedures: helping you to reduce the cyber risk to your business

Cyber attacks are a constant threat to businesses of every size and sector. Putting robust cyber security procedures in place is one of the most effective ways to strengthen your organisation’s cyber resilience. It can also support cyber insurance applications by helping you demonstrate that appropriate controls are in place.

Updated: 10.07.26

By Phil Thorpe

Cyber security procedures

To help you better understand cyber security procedures, we look at what they are, why they matter, and how you can build and maintain them effectively.

What are cyber security procedures?

Cyber security procedures are the documented policies, processes, and rules that govern how an organisation protects its systems, data, and people from cyber threats. They set out what employees should do and what they should avoid in areas such as data handling, device use, and responding to suspect activity.

Alongside technical measures like firewalls and antivirus software, cyber security procedures address human and organisational risks. They create a shared framework that helps everyone understand their role in protecting the business from cyber threats.

Why is having a cyber security procedure important?

Strong cyber security procedures foster a proactive security culture. Relevant policies connected to routine tasks are more likely to be understood, adopted, and followed. Cyber threats to businesses are increasingly common and becoming more likely than any other form of insurance loss.

Businesses of all sizes are at risk

Smaller businesses often think they’re not targets. In reality, attackers frequently pursue them because they have fewer protections. However, simple, well-integrated processes in small teams can be effective and easier to adopt than complex rollouts in large organisations.

Businesses are legally required to protect the personal data they use and store. If your business suffers a breach and you haven’t taken adequate precautions, you could be investigated by the Information Commissioner’s Office (ICO) and face restrictions, warnings, and significant fines. Similarly, protecting corporate data is often stipulated within client contracts and, therefore, failure to do so can result in significant financial penalties.

Security is about people and processes, not just technology

Cyber security protection should never be limited to systems and software. People and processes are just as important, and statistics show that 60% of cyber breaches in 2024 involved human error and, according to some studies, this is as high as 95% of all security incidents. Given recent shifts in working practices, including the growth of remote working and reduced IT oversight of devices, appropriate staff training and awareness is more relevant than ever.

What areas should be assessed for a cyber security procedure?

Effective cyber security procedures address several areas. Each requires specific attention but must also be considered together. Key areas include:

  • Remote working. Defines acceptable use of personal devices, home networks, and remote access tools. With hybrid working now standard in many organisations, remote working policies are important to prevent unsecured connections from becoming entry points for attackers.

  • Access control. Governs who can access which systems and data, and under what circumstances. The concept of least privilege (granting employees access only to what they need for their roles) limits the potential damage from a compromised account.

  • Password management. Sets standards for password strength, uniqueness, and storage. Policies should address the use of password managers and multi-factor authentication (MFA) as a minimum requirement.

  • Physical security. Covers protection of physical assets such as laptops, servers, and printed documents. Even strong digital defences can be undermined if a device is left unattended or a visitor gains access to restricted areas.

  • Device security. Ensures all devices used for work, whether company-owned or personal, meet minimum security standards, including encryption, up-to-date software, and remote wipe capabilities.

  • Data handling and classification. Establishes how data should be categorised, stored, shared, and disposed of. Knowing what information you hold, where it lives, and who can access it is fundamental to effective data protection.

  • Third-party and supply-chain risk. Many businesses rely on outsourced IT and HR support, software providers, payment platforms, and other suppliers. Your procedure should explain how these third parties are vetted, what level of access they are granted, and the security expectations they must meet. This matters because only 14% of UK businesses formally review cyber risks posed by immediate suppliers, and only 7% assess their wider supply chain. You should ensure that, as a minimum requirement, any outsourced support service which have access to your systems and data, can only do so via a MFA process.

  • Incident reporting. Provides employees with a clear process for reporting suspected breaches or suspicious activity. Early reporting is critical for minimising the damage of a cyber incident.

Bringing together cyber security specialists and colleagues from different departments, including IT, legal, procurement, HR, marketing, and finance, helps to ensure all these areas are assessed from multiple angles.

How do you put together a cyber security procedure?

Developing effective cyber security procedures is a structured process involving representatives from across the organisation. Consulting different teams ensures policies reflect how your business operates.

The principal steps for putting together a cyber security procedure are:

  1. Assess your current position. Begin with a discovery phase. What cyber security measures, if any, are already in place? What are the most important assets to protect (customer data, banking systems, intellectual property, etc.)? Are there industry-specific compliance requirements or certifications you need to meet? 

  1. Identify your risks. Map out where your vulnerabilities lie across the areas covered above: remote working, access control, devices, and so on. Risk identification should directly shape the priorities and direction of your procedures. You can read more about this process in our guide to identifying and mitigating cyber security risks.

  1. Develop and implement your procedures. Move from assessment to action. Procedures should be directly relevant to your specific working practices, not generic templates. Involve the departments responsible for day-to-day implementation at this stage.

  1. Test your procedures. Don’t wait for an incident to find out whether your procedures work. Desktop exercises and scenario-based simulations that test both processes and employee responses are an effective way to identify weaknesses and build confidence before a real cyber attack occurs. Making scenarios personal and relevant to participants improves engagement and retention.

  1. Review and update regularly. Cyber threats evolve constantly, and so does your business. Procedures need regular review to remain relevant. Without consistent upkeep, new systems or software may not be accounted for, and different departments may develop inconsistent approaches to security, creating vulnerabilities. Recent advances in AI means that businesses are now even more susceptible to cyber attacks than they were 12 months ago.

It’s also worth emphasising the right culture around procedures. Cyber security processes shouldn’t be about catching employees out; they should be framed as a set of supporting principles that protect both the business and its people, encouraging ongoing learning rather than fear of blame.

What else can businesses do to protect themselves?

Procedures and policies form the core of strong cyber security. Additional measures further reduce risk. These include:

  • Staff training. Regular training keeps your team up to date on emerging threats and ensures that procedural changes are communicated clearly. It also gives employees a sense of shared accountability for the organisation’s security. This matters because many breaches involve the human element, whether by error, misuse, stolen credentials, or social engineering.

  • Incident response planning. A well-developed incident response plan outlines exactly what your business will do in the event of a cyberattack. It should set out who is responsible, what steps to take and how to limit the damage. Like your procedures, it should be tested regularly and updated as your business evolves. Most importantly, it should contain details of your insurer’s emergency response contact points in order to ensure swift mitigation of threats posed.

  • Cyber security audits. A cyber security audit provides an independent assessment of your vulnerabilities, helping you identify weaknesses before attackers do. Audits are valuable as your business grows or after significant changes to your systems or ways of working.

  • Risk mitigation controls. Technical controls, such as multi-factor authentication, network monitoring, and frequent software patching, sit alongside your procedural measures to give layers of protection that make it significantly harder for attackers to succeed.

Cyber security insurance to support your procedures

Cyber security procedures reduce the likelihood of an incident. However, policies cannot eliminate risk entirely. That’s why a tailored cyber insurance policy is so important.

According to the Government’s 2025 Cyber Security Breaches Survey, almost half of businesses (45%) have some form of cyber security insurance, but in most cases this is bundled into a wider policy rather than dedicated cyber cover tailored to the business’s specific risks. Only 7% hold a specific cyber insurance policy.

At Alan Boswell Group, our specialist team can help you assess your cyber insurance needs and find a policy that aligns with your risk profile and complements the procedures you have in place. To discuss cyber insurance for your business, contact us on 01603 218000, or explore our cyber insurance page for more information.

Need help with your insurance?

Whether you need a quote, have a general enquiry, or want to talk it through over the phone, we're here to help.

Speak to us:  01603 218000

Related guides and insights

9 mins
Cyber security

Cyber security audits explained

Cyber security audits help identify weaknesses and vulnerabilities, thereby lowering the risk of your business becoming a victim of cybercrime.

9 mins
Cyber security incident planning

What is a cyber incident response plan?

A cyber incident response plan (IRP) outlines your business’s approach to handling a cyber security incident. Here’s why all businesses should have a plan to protect against the threat of cyber attacks.

9 mins
Cyber security risks

Identifying and mitigating cyber security risks in your business

Human error accounts for 95% of all cyber breaches, while more than one in four businesses experienced a cyber security breach in the last 12 months. Here’s how to identify and mitigate cyber security risks for your business.

10 mins
A-Z of cyber security

Glossary of cyber insurance terms

In this article, we demystify some common cyber insurance terms so you can be confident you’re getting the right policy for your business.