IT Policy Pack for Small Businesses (EU) — acceptable use, passwords/MFA, backup and incident response in one pack

Most small organisations never get around to writing down acceptable-use, password, remote-work, backup and incident-response rules until a customer questionnaire, insurance renewal or an actual incident forces the question. This pack gives organisations of about 2 to 50 staff a complete, EU-specific set in one pass — plain English, editable in Word and Excel, each policy mapped to the GDPR, NIS2 art. 21(2), ISO/IEC 27001:2022 Annex A and the ENISA SME guide, so the same documents also help when a customer sends you a security questionnaire.

€39 VAT-incl. · one-time, no subscription
Buy now →

What's inside (11 files + bonus)

  1. Acceptable use policy (.docx) — accounts, devices, software, payment-fraud checks, three simple information labels, generative AI tools, monitoring that respects staff privacy, reporting mistakes.
  2. Passwords, MFA and access policy (.docx) — password rules in line with current European guidance (long, unique, no forced 90-day changes), where MFA is required, admin accounts, access reviews.
  3. Remote work and own devices policy (.docx) — three models to choose from, minimum device rules, what the employer can and cannot see or wipe on a personal phone.
  4. Backup and recovery policy (.docx) — a fill-in table per system (frequency, retention, RPO/RTO), 3-2-1 plus one copy out of ransomware's reach, cloud services, restore tests.
  5. Incident response plan (.docx) — roles, a printable contact list, six steps, and a notification check: GDPR 72 hours, NIS2 24/72 hours if you are in scope, contracts, insurer; severity table, incident log.
  6. The 12 rules on one page + staff acknowledgement (.docx).
  7. Joiner / mover / leaver checklist (.xlsx) — 27 IT steps with status and progress, plus a systems list.
  8. Supplier risk checklist (.xlsx) — dropdowns, automatic score and priority per supplier.
  9. Implementation tracker (.xlsx) — 37 measures with owner, due date, status and evidence, a progress summary, and a review calendar for the recurring tasks (restore tests, access reviews, policy review).
  10. 1-page action plan (PDF) — five steps, about six hours in three sessions.
  11. Read me first (.docx) — how to use the pack, licence, dated source list.
  12. Bonus: AI assistant — ready-made prompts to fill in every policy and spreadsheet with Microsoft 365 Copilot, ChatGPT, Le Chat, Claude or Gemini, plus a Claude skill and instructions for your own GPT or Copilot agent. The AI drafts, you check and decide; with a privacy section (business account, no personal data or system details).

Need to show NIS2 supplier due diligence too? The NIS2 Supplier Kit (EU) (€69) adds a does-it-reach-me self-check, a 10-area self-assessment and a customer-questionnaire answer kit — the two packs are designed to be used together.

Mainly answering customer questionnaires? The full Security Questionnaire Answer Bank (63 questions, English + Dutch, €39) is available on its own.

Each policy ends with a table mapping it to the GDPR, NIS2 art. 21(2), ISO/IEC 27001:2022 Annex A and the ENISA SME guide. Works in Word, Excel, Google Docs/Sheets and LibreOffice. Instant .zip download after purchase.

Who this is for

  • Small and growing EU organisations (roughly 2–50 staff) without a complete, written set of IT and security policies yet.
  • IT, HR or office owners who need acceptable use, passwords/MFA, remote work, backup, incident response and supplier risk handled in one pass, mapped to the GDPR, NIS2 and ISO 27001 so the same work also answers a customer questionnaire.
  • Anyone who already has (or is considering) the NIS2 Supplier Kit (EU): that kit's self-assessment points at which risk areas need attention; this pack supplies the policies and trackers themselves.

FAQ

Is this mandatory for my organisation?
No — this pack is best-practice operational hygiene, not tied to one law with a single deadline. Each policy maps to the GDPR, NIS2 art. 21(2), ISO/IEC 27001:2022 Annex A and the ENISA SME guide, so you can show the same work against whichever of those applies to you.
Is this legal advice?
No. This is a template, not legal advice — no guarantee of full legal compliance, and it is not an ISO 27001 certification kit. Check the sections on monitoring and personal devices against employment rules in your own country.
How does this work with the NIS2 Supplier Kit (EU)?
The NIS2 Supplier Kit's self-assessment points at which of the 10 statutory measure areas need attention and whether NIS2 reaches you at all; this pack supplies the underlying policies and trackers themselves, for organisations who want their IT house in order regardless of whether NIS2 applies.
Which software does this work in?
Standard .docx/.xlsx/.pdf files — opens in Word, Excel, Google Docs/Sheets and LibreOffice, no special software required.
How long does this take to work through?
The action plan is designed for about six hours across three sessions for an organisation of 2–50 staff; larger or more complex setups may take longer.

Template, not legal advice. No guarantee of compliance with any law or standard, and not an ISO 27001 certification kit. Check the sections on monitoring and personal devices against employment rules in your own country. Based on the GDPR, Directive (EU) 2022/2555 (NIS2) art. 21 and 23, ISO/IEC 27001:2022 Annex A and ENISA SME guidance — dated source list in the Read-me. Prepared with the help of AI under the direction of Lerider Technologies and checked against its factual/legal references before publication.

Refunds: if this pack isn't useful for you, email within 14 days of purchase for a full refund, no questions asked.

At checkout you accept our terms (Dutch, with an English summary). See also refunds and privacy.