IT policies are the part of running a business that nobody gets excited about, and the part everyone wants when something goes wrong. A policy sets the standard for how your people use technology, and that affects your security, your culture and, sometimes, your legal exposure. No matter how big your company is, these are the five I would put in your employee handbook. This list first ran in 2022, and we have updated it for how people work now.
1: Bring your own device (BYOD) policy
Letting employees use their own phones for work saves you the cost of buying and managing devices, and your people like using something they already know. If you allow it, you are probably doing it already, just without anything written down. That’s where the problems start.
Your policy should answer a few plain questions. Is the phone still getting security updates from its manufacturer? Is business data on it protected by a PIN and encryption? And what happens to company email and files when an employee leaves or loses the phone? Mobile device management (MDM), the software that lets a business enforce settings on devices, is how you get a real answer to that last one. We use Microsoft Intune for this. On a personal phone, it can protect and remove only the company’s apps and data and leave the employee’s photos and messages alone, which makes people far more willing to agree to it.
Decide whether you reimburse for phone use, and which number clients call. A business number through a phone system like our Xennect Phone System keeps client calls off personal numbers. For a fuller checklist, see our BYOD dos and don’ts guide.
2: Password security policy
Stolen logins are still how a lot of attacks get started. Verizon’s 2026 Data Breach Investigations Report found that half of the ransomware victims in its data had a credential or infostealer event (malware that steals saved logins) within the 95 days before the attack.
Start with a company password manager and require everyone to use it. It keeps credentials under your control, so when someone leaves you still have access to what they used and they keep nothing. We use one at Xentric, and I would not run a business without it. Here is why a password manager is a business essential. Second, require multi-factor authentication (MFA) on email and on every business system that offers it.
Third, update the old rules. Most of us were taught to add a symbol and a capital letter and change the password every 90 days. That advice mostly produced predictable passwords like Summer2026!, and NIST, the federal standards body, no longer recommends it. It now tells organizations not to force symbols or calendar-based changes. It asks for length instead, with 15 characters as the minimum when a password is the only login. A password should change only when there is evidence it has been compromised. A password manager makes this easy, because nobody has to remember the long ones.
3: Public Wi-Fi use policy
Public Wi-Fi is less dangerous than it was in 2022, because most websites now encrypt your traffic by default. It still deserves a policy. The remaining risk is a fake hotspot the bad guys name to look like the coffee shop’s network, and a laptop that is not patched or managed.
Do you allow business laptops on public networks? My recommendation is to allow it on company-managed devices that are patched and protected with MFA, and to have people use their phone’s hotspot for anything sensitive, such as payroll or banking. If your team works from a lot of different places, a VPN adds another layer. Whether the cost is worth it is up to you. Make sure this policy and your BYOD policy agree with each other.
4: Approved applications policy
Employees constantly break this one, and I understand why. When someone can’t get a job done with the tools you gave them, they find one that works. That usually means they are trying to be productive, and you don’t want to punish it.
The problem is that software the company doesn’t know about, called shadow IT, never gets patched, never gets backed up and does not get shut off when that person leaves. Your policy should list the approved apps and give people an easy way to ask for a new one. For instance, a simple request to IT with a yes or no inside a few days works better than a ban people quietly work around.
5: AI use policy
Imagine one of your account managers is behind on a proposal. They paste a client’s contract and pricing into a free AI chatbot, from a personal account, to get a quick summary. Nobody meant any harm, and your client’s information is now in a tool you did not choose, under terms nobody at your company has read.
It happens more than most owners expect. Microsoft and LinkedIn’s 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work, and the figure is as high as 80% at small and midsize companies. IBM’s 2025 Cost of a Data Breach report found that one in five organizations had a breach tied to shadow AI, meaning AI tools used without company approval. Organizations with high levels of it paid an average of $670,000 more per breach. IBM also found that 63% of breached organizations either had no AI governance policy or were still developing one.
Your policy does not need to ban anything. It should say which AI tools are approved and under whose accounts. It should name the data that never goes into any AI tool: client records, financial data, credentials and health information. And it should make clear that the employee is still responsible for checking AI output before it goes to a client. It doesn’t have to be perfect on day one. These tools change quickly, so plan to revisit it down the road. Our guide on how to prepare your business for AI without handing over your data goes deeper.
You also don’t have to roll out all five at once. If I had to pick a starting point, it would be the password manager and MFA, then the AI policy, and the rest can follow as you grow.
If you want these five in your handbook but would rather not start from a blank page, or you want to know how your current setup compares, reach out. We’ll take a look at it and take it from there.