Policies, Training and a 90-Day Plan

The first ten lessons covered accounts, computers, cloud tools, email, networks, phones, scams, cards and records, and the bad day. A shop that did all of it in one month would burn out by the second. So this lesson does three jobs. It turns the habits into a short written policy. It makes the habits recur, through small training and kind drills. And it puts the work on a calendar with names on it.

The frame comes from the NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide (NIST SP 1300, February 2024). It groups security outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST says the guide is for small and medium businesses with modest or no cybersecurity plans, and that it is voluntary. Govern comes first on purpose. It means someone decides who is responsible, what rules apply and when they are reviewed. A policy is how a small firm does that.

A security policy for ten people

A security policy is a short written set of rules for how the business handles accounts, devices, data and incidents. Large firms have binders. A shop of 10 needs two pages, written in the words people already use, with a signature line. The FTC's Cybersecurity Basics page says to have a plan for saving data, keeping the business running and notifying customers after a breach, and to train employees on a regular schedule. A policy holds those promises in one place.

Idaho gives you a second reason. Under Idaho Code 28-51-106, a business that has its own breach notice procedures as part of an information security policy is treated as compliant with the notice requirement in 28-51-105, as long as the procedures meet the timing in that section and it follows them. A written incident section is therefore not busywork. Lesson 10 covers the notice rules.

Here is a sample for an invented business, Redwater Tile and Stone, 10 people. Copy it, change the names and trim whatever does not fit.

That is about 450 words, and it fits one page. The second page is the incident card from lesson 10 and a list of which tools hold which data. Notice what the sample leaves out: buzzwords, citations to standards and anything the owner does not intend to enforce. Every rule on that page should be something you will check.

Acceptable use, in plain terms

Acceptable use is the part of a policy that says what company computers, email, accounts and networks may and may not be used for. Keep it short and honest. People will check personal email at work, so decide what is fine (a quick look at a bank balance on a break) and what is not (installing a free game, forwarding company files to a home account). Say which things the owner can see: company email, files on company storage and web filtering logs. Employees who know the rules in advance feel less watched, not more.

Making the policy stick

• Hand it to every new hire on day one with the account setup, not in a pile of forms.
• Read it aloud once a year in a staff meeting. Ten minutes. Take questions.
• Store the signed copies where the office manager can find them and where they do not live on a computer that might be down.
• Change the policy when practice changes. A rule everyone ignores teaches that all rules are optional.

Training in 15 minutes a month

The FTC's Cybersecurity Basics page says to run training on a regular schedule and update staff as new risks emerge. The SBA names employees and their work communications as the leading cause of small business data breaches. NIST's small business pages point to free and low-cost learning content, but they do not prescribe a schedule or a curriculum, so the schedule below is a suggestion built from this course, not a standard.

One topic a month. Fifteen minutes at the end of a regular staff meeting. One real example, ideally something that landed in your own inbox with names removed. Then one question: what would you do? Then stop.

Month	Topic	Source lesson
January	Read the policy aloud; set up or check your two-step sign-in	This lesson, lesson 02
February	Passwords and the password manager	Lesson 02
March	Spotting phishing and fake invoices	Lessons 05, 08
April	Updates, screen locks, lost-device steps	Lessons 03, 07
May	The payment call-back rule, with a role play	Lesson 08
June	Cloud files: sharing links and who has access	Lesson 04
July	Working away from the office: home, public Wi-Fi, travel	Lessons 06, 07
August	Customer cards and records: what we keep, what we shred	Lesson 09
September	Backups: show how to restore a file	Lesson 03
October	Incident card walk-through: who calls whom	Lesson 10
November	Holiday scams and seasonal staff onboarding	Lessons 02, 08
December	What went wrong this year and what we fixed	Annual review, below

Cost: nothing but the time. Twelve sessions at 15 minutes is three hours per person per year. With 10 people that is 30 hours of payroll. At an invented $24 an hour that is $720, or about $72 a person. It is the cheapest control in the course, and it is the only one that covers the gap between what the software blocks and what a convincing message can talk someone into.

Phishing drills done kindly

A phishing drill is a practice message sent by the employer to teach staff to spot and report real ones. The FTC's small business page names free phishing simulators from Microsoft and KnowBe4 as places to start; check what your own plan includes before you rely on either. Some email platforms bundle a simulator in higher tiers, and a manual drill costs nothing: the office manager sends a harmless fake "shared document" note from a free account.

The danger with drills is that they turn into a trap. Set the tone before the first one:

• Announce that drills will happen. Do not announce when.
• Never post names, never rank departments and never put a click in a personnel file.
• Reward the report. The score that matters is how many people flagged the message, and how fast, not how many clicked.
• Follow up within a day with the tells, shown on the actual message.
• Run two to four a year, mix the difficulty and include the money-moving kind: a fake vendor bank change aimed at whoever pays the bills.
• Include the owner. The owner's account is the one an attacker most wants.

If an employee clicked on a real phishing message last month and said nothing, the drill program is not working yet. Make reporting easier first: a forward-to address, a button in the email client or just a text to the office manager.

Cyber insurance basics

Cyber insurance is a policy that pays some of the costs of a data breach, ransomware attack or fraud. The FTC's cyber insurance page advises talking with your insurance agent and sorting out whether you need first-party cover, third-party cover or both.

• First-party coverage pays your own costs. The FTC lists forensic investigation, recovering or replacing lost data, customer notification and call center services, lost income from business interruption, crisis management and public relations, cyber extortion and fraud, and fees, fines and penalties tied to the incident.
• Third-party coverage pays when outsiders make claims against you. The FTC lists payments to affected consumers, settlements, litigation and regulatory response costs, and other damages and judgments.

The FTC page also suggests checking whether the policy covers data breaches, attacks on data held by vendors or other third parties, network breaches and attacks outside the U.S. It says to look for "duty to defend" wording, to ask whether the cover applies in excess of other insurance you hold, and to ask whether the insurer offers a breach hotline that is available every day of the year at all times. NIST's small business page on cyber insurance does not give specifics. It points to the FTC, the Cyber Readiness Institute and the U.S. Chamber of Commerce.

What an application asks

The FTC page does not list what insurers require, and NIST's does not either. Applications differ by insurer and change from year to year, so read yours. In practice, applications for small businesses commonly ask about the same few controls: multi-factor authentication on email, remote access and critical accounts, offline or immutable backups that have been tested, up-to-date patching, endpoint protection, staff training, a written incident plan, and how you verify changes to payment details. The FBI's 2025 IC3 report recommends the first three of those. No insurer's current form was reviewed for this course, so treat the list as a reading guide and not as a rule.

A few habits help.

• Answer from what is true today. Ask the office manager to confirm each yes before the owner signs. A wrong answer is worse than a no, and your policy's wording on misstatements is worth reading before you sign.
• Put the breach hotline number on the incident card and in everyone's phone. Many policies set notice deadlines and some require approval before you hire help.
• Ask what happens if your own controls lapse. If a policy assumes two-step sign-in everywhere and one old mailbox does not have it, find out whether that matters before you need to know.

The vendor checklist

Every tool that holds your data is a vendor: the payroll service, the accounting program, the card processor, the website host, the cloud backup, the IT provider and the shredding company. The FTC's small business page has a section on vendor security, and lesson 04 listed the questions to ask before signing. Here they are on one page. Ask in writing and keep the answers with the contract.

Ask	A good answer sounds like
What of our data do you hold, and where is it stored?	A specific list, and a named country or region
Do you offer two-step sign-in, and can we require it for all our users?	Yes, with an admin setting
Who at your company can see our data?	A short answer about roles, not "our team"
How fast will you tell us if you have a breach?	A number of days or hours in the contract
Can we export our data in a usable format, and what happens to it when we leave?	Yes, how, and a deletion date
Do you back up our data, and how fast can you restore it?	Yes, with a stated time
Which other companies handle our data for you?	A list, or a promise to notify you of changes
Do you have an independent security report?	Yes, or a plain answer about why not

A vendor that cannot answer these in a few days is telling you something. Small vendors may answer thinly and still be fine, so weigh the answers by what the vendor holds. A tool that only handles public brochures needs fewer answers than one that stores employee Social Security numbers.

A 30/60/90-day plan

The order matters. Accounts and backups come first because they block the most common routes in and soften the worst outcomes. Devices and updates follow. The response plan and the policy come once there is something to protect. The sequence below reflects the priorities in this course. It is a recommendation, not a requirement from any single standard.

Days 1 to 30: accounts and backups

1. Name the person in charge, usually the office manager, and a backup. Write both names on the first page of the policy.
2. List every account that touches money, email or customer data. Give each person their own login; retire shared ones (lesson 02).
3. Turn on two-step sign-in for email, the bank, payroll, accounting and the password manager. Use an app or key where you can.
4. Choose a password manager. Bitwarden's business page lists its Teams plan at $4.00 per user per month, billed annually, as of October 2026. Other products exist, and most have similar tiers.
5. Check backups. Confirm there is one copy off the premises and one that cannot be changed or deleted from a compromised computer. Restore one file to prove it works (lesson 03).
6. Write down the bank's fraud line, the processor's number, the insurer's hotline and the outside IT number. Post the incident card (lesson 10).

Days 31 to 60: devices, email and updates

1. Make a list of every computer, phone and tablet that touches company data, and who has it (lesson 03).
2. Turn on automatic updates and disk encryption, and set screen locks. Verizon's 2026 report page says 31 percent of breaches start with a software vulnerability.
3. Check the email domain's SPF, DKIM and DMARC records with your provider so criminals cannot easily send mail in your name (lesson 05). Review forwarding rules in every mailbox.
4. Change the router's default password, turn off remote management and set up a guest network (lesson 06).
5. Review who can see which shared files and which apps are connected to your cloud accounts (lesson 04).
6. Write the payment call-back rule into the policy and tell everyone who handles money (lesson 08).
7. Send the policy for signatures. Hold the first 15-minute training.

Days 61 to 90: response, records and review

1. Run a 30-minute tabletop exercise with the incident card. Read a made-up scenario aloud, such as "the bookkeeper's mailbox is sending invoices," and walk through who calls whom. Fix what the card is missing.
2. Send the vendor checklist to your five most important vendors. Keep the replies.
3. Review what you hold and for how long. Shred what you do not need (lesson 09).
4. Read your cyber insurance policy, or get quotes, using the FTC questions above.
5. Send the first phishing drill, after telling staff drills will happen.
6. Meet for 45 minutes. Review what got done, what did not and why. Put each unfinished item on the calendar with a name and a date.

Who does what

Task	Owner	Office staff	Outside IT provider
Approve the policy and the budget	Decides, signs first	Drafts, collects signatures	Reviews technical items
Accounts, two-step sign-in and password manager	Sets the rule, uses it	Rolls it out, helps people	Sets admin options
Backups and restore tests	Funds	Does the quarterly file restore	Builds and monitors
Monthly 15-minute training	Attends, sets the example	Runs it	Supplies examples on request
Phishing drills	Approves, is included	Sends, tallies reports	Helps if there is a platform
Cyber insurance	Signs the application	Checks each answer against reality	Confirms technical answers
Vendor checklist	Decides whether to keep a vendor	Sends and files replies	Reads technical answers
Annual review	Chairs	Writes it up	Contributes

The annual review

Once a year, in December or January, set aside two hours. Bring the policy, the incident card, the vendor replies, the insurance policy, the account list and the notes from any incident or drill.

• What changed in the business? New staff, a new tool, a new location, a new kind of customer data.
• Is each rule still true? Strike what nobody follows or start following it.
• Who left? Confirm their accounts and devices are gone.
• Do the numbers on the incident card still work? Call each one.
• Did we restore a file from backup this year? If not, do it now.
• What did drills and near misses teach us? Pick the one change that would have helped most.
• What will we spend next year, and on what?

Write the result on a single page, date it and put it on top of the signed policies. NIST's guide covers six functions, so use them as your agenda: Govern (who decides), Identify (what we hold), Protect (what blocks), Detect (what we would notice), Respond (the card) and Recover (the restore test).

What it costs: a rough budget

Few public sources give a firm number for what a small business should spend on security, and a number from a vendor that sells the product is a sales figure. The ranges below are planning estimates built from the pieces of this course, in U.S. dollars per year. They are not drawn from a survey and they are not quotes. The only verified price here is the password manager line, which comes from Bitwarden's page. Get two or three real quotes before you set a budget.

Item	1 to 5 people	6 to 15 people	16 to 50 people	Basis
Password manager	$0 to $250	$300 to $750	$750 to $2,400	Bitwarden Teams $4.00 per user per month billed annually = $48 per user per year; other products vary
Security keys or authenticator rollout	$0 to $150	$100 to $500	$500 to $1,500	Rough; one-time for hardware
Backup (cloud files, email and offsite copy)	$100 to $400	$400 to $1,500	$1,500 to $6,000	Rough; depends on data size
Endpoint protection and device management	$0 to $300	$300 to $1,500	$1,500 to $6,000	Rough; often included in a business plan you already pay for
Outside IT help (retainer or hourly)	$0 to $600	$600 to $3,000	$3,000 to $12,000	Rough; hourly rates vary by region
Cyber insurance	$300 to $1,500	$800 to $3,000	$2,000 to $8,000	Rough; varies by revenue, industry and controls
Training and drills	$0	$0 to $300	$0 to $1,000	Free resources; paid platforms optional
Staff time (see the training math above)	$100 to $400	$700 to $1,500	$2,000 to $5,000	Hours at your own wage rate

Adding the columns, a rough total runs about $500 to $3,600 for 1 to 5 people, $3,200 to $12,000 for 6 to 15 and $11,000 to $42,000 for 16 to 50. These are broad ranges because shops differ so much. Insurance and outside IT often run the largest lines, and free or built-in features cut the middle rows. Spend the first dollars on accounts, backups and updates. Spend the next on a person who can answer the phone when something breaks.

Questions and answers

How long should the policy be?

Two pages for a business of 10. If a rule needs a paragraph of explanation, put the explanation in the monthly training and the rule on the page. NIST's guide is for businesses with modest or no cybersecurity plans, and it is a short document for the same reason.

Who should write it?

The office manager drafts it, since that person knows how work really happens. The owner approves it, because a policy the owner exempts themselves from will not last. An outside IT provider reads the technical items. Do not buy a template and sign it unread.

Do we need staff to sign it?

It is a good habit. A signature shows that each person saw the rules and had a chance to ask questions. It also gives the office manager a natural reason to hand the page to a new hire.

What if an employee refuses to use two-step sign-in?

Start by finding out why. The usual reasons are a phone they do not want to use for work, a bad experience with codes or worry about being tracked. Offer a security key or an authenticator app that stores nothing personal. For access to money, payroll or customer data, the answer has to be yes. The FBI's 2025 IC3 report recommends multi-factor authentication for all services to the extent possible, particularly webmail, VPNs and accounts that reach critical systems.

How often should we do phishing drills?

Two to four a year is plenty for a small shop. Beyond that, people tire of them. Mix easy ones and hard ones, and count reports, not clicks.

Is cyber insurance worth it for a business our size?

It depends on what you hold and how long you could survive a bad month. The FTC's page says cyber insurance can help protect against losses from an attack and tells you to compare coverage with your agent. A shop with customer financial data or a heavy dependence on a computer system has more reason to carry it. A shop that holds little data and could restore from backups in a day has less. Get a quote and decide with the numbers in front of you.

What should we do if we cannot afford an outside IT provider?

Do the free and cheap things in the first 30 days yourself: two-step sign-in, a password manager, automatic updates, backups and the incident card. The SBA lists free tools and planning resources on its cybersecurity page, including a federal vulnerability scanning offer for small businesses, and NIST has a finder for regional non-profit support programs. Check each program's current availability before you count on it.

Should we use a template from the internet?

Use it as a checklist for what to include, not as the final text. A template written for a 500-person company contains rules you will never follow, and it is how many policies end up unread. Cut it to your size and read every line aloud before it goes out.

How do we keep this going after the first 90 days?

Put the monthly training and the January review on the calendar as recurring events with a named owner. Put the quarterly restore test on the same calendar. If the work depends on someone's memory, it will be skipped in the busy season.

Hard questions

Isn't a written policy just paperwork that protects the owner and nobody else?

It can be, if it is written to sound official and nobody follows it. A good one does real work. It turns a vague expectation into a rule that a new hire can read, and it gives the owner and the staff the same page when a decision comes up under pressure. In Idaho it also does a specific job: Idaho Code 28-51-106 treats a business that has breach notice procedures in its own information security policy as compliant, if the procedures meet the timing in 28-51-105 and it follows them. A rule you do not enforce is worse than none, so write only what you will check.

Won't drills and monitoring make employees feel like suspects?

They can. That is why the tone matters more than the tool. Announce the program, keep results private, reward reports and include the owner. Be open about what you can see on company systems. Staff who trust the program report more, and reports are what you want.

If criminals are using AI to write perfect phishing, doesn't training become pointless?

IBM's 2026 report page cites a 56 percent increase in AI-driven attacks, led by deepfake impersonations and AI-enabled malware. Polished grammar is no longer a tell. That changes what training teaches, not whether to train. Spelling mistakes matter less. Process matters more: the call-back rule, the second approver and the habit of stopping when something creates urgency. Those controls work even when the message is perfect.

Our margins are thin. Why spend money on this instead of marketing?

Because the numbers are lopsided. The FBI's 2025 report logged 24,768 business email compromise complaints with $3,046,598,558 in reported losses, which averages about $123,000 per complaint (3,046,598,558 divided by 24,768 is about 123,000). Many of the controls in this lesson are free or cost less than $50 a person a year. Start with those. And a basic cyber insurance policy, if you buy one, is a way to turn a small possibility of a very large loss into a known cost.

Nobody has attacked us in ten years. Is the plan an overreaction?

Maybe nobody has attacked you that you know of. The FBI says IC3 now averages almost 3,000 complaints a day, and 2025 produced 1,008,597 complaints with $20.877 billion in reported losses. Attackers send the same message to thousands of businesses and keep the ones that answer. The 30/60/90 plan is not a promise of safety. It is a cheap way to be less easy.

What if the owner will not follow the policy?

Then the policy is not a policy yet. Staff watch what the owner does. If the owner shares a login, skips two-step sign-in or approves a payment change by email, everyone learns the rules are optional. Put the owner's name first on the signature page, include the owner's account in drills and let the office manager decline a payment request from anyone who skips the call-back.

Pictures, Numbers and Infographics

Everything in this section is for printing, posting and pointing at. The table is the set of figures this course relies on, with where each one came from and what it can and cannot tell you. Figures are as of October 2026.

Verified figures

Figure	Value	Source and caution
Complaints to FBI IC3 in 2025	1,008,597, with $20.877 billion in reported losses	FBI IC3 2025 report. Reported losses only; many victims never report
Business email compromise complaints, 2025	24,768, with $3,046,598,558 in reported losses (about $123,000 per complaint)	IC3 2025. The average is a simple division; it mixes small and large cases
Tech and customer support scam losses, 2025	$2,134,675,818 from 47,794 complaints	IC3 2025
Ransomware complaints, 2025	3,611, with $32,320,105 in adjusted losses	IC3 2025. The report says this does not usually include lost business, time or remediation, so it understates the cost
Financial Fraud Kill Chain, 2025	3,900 incidents; $1,163,919,846 attempted; $679,013,183 frozen; 58 percent success rate	IC3 2025. An average across cases, not a prediction for any one
Share of breaches involving ransomware	48 percent	Verizon 2026 DBIR page. All organization sizes
Share of breaches that start with a software vulnerability	31 percent	Verizon 2026 DBIR page. Verizon says this now beats stolen passwords as the top way in
Global average cost of a data breach, 2026	$4.99 million, up 12 percent	IBM report page. Skewed by large organizations; not a small-shop bill
Increase in AI-driven attacks	56 percent	IBM 2026 report page
NIST CSF 2.0 functions	Govern, Identify, Protect, Detect, Respond, Recover	NIST SP 1300, February 2024. Voluntary guidance
Business password manager, example list price	$4.00 per user per month, billed annually	Bitwarden Teams page. One product; prices change
Idaho breach notice standard	"most expedient time possible and without unreasonable delay"; no fixed number of days	Idaho Code 28-51-105; own-procedure safe harbor in 28-51-106

Not verified against a primary source: the budget ranges above (estimates made for this course), the list of what insurance applications ask (common practice, no insurer form reviewed) and the training schedule (a suggestion). Claims about the effect of any one control on breach rates are left out because none was confirmed.

Picture 1: layers of defense on a calendar

Read it from the top. The solid frames are the first 60 days. The dashed ones are the response and the habits that keep the rest alive. No layer stops every attack on its own, which is why there are six.

Picture 2: the 3-2-1 backup rule

The FBI's 2025 report recommends off-site or offline backups that are encrypted and immutable, meaning they cannot be altered or deleted. Copy 3 is that copy. Lesson 03 covers the details.

Picture 3: 30, 60 and 90 days

Print this one and put it next to the incident card. Cross off each item with a date, and put a name beside any that slip.