Why we built it

A copied policy that nobody reads does not guide real work. Who closes an account, where sensitive files belong and who verifies a suspicious payment request all need clear rules.

How it helps

The generator draws on the company’s practical experience. An internal policy template intended for different sectors helps explain the responsibilities of staff, management and IT. The resulting document is adapted to the organisation’s processes and approved with the responsible people.

For public and private organisations, business owners, IT and security teams, HR and finance departments.

Practical tasks

01

Employee leaves — account closed?

Former employees’ active accounts are a recurring risk. Define how access is granted, changed and revoked, and assign responsibility.

02

Personal records outside shared folders

Clarify storage, permissions, sharing and deletion rules for passport copies and other sensitive files. Access should follow a work-related need.

03

A payment request ‘from the director’

Set an independent channel to verify urgent instructions, define payment approval authority and explain how suspicious requests are reported.

04

An owner for the policy

Staff communication, assigned responsibilities and review when processes or threats change help the rules work in daily operations.

How to use it

  1. 01

    Prepare a template

    Start preparing your organisation’s internal cybersecurity policy on the generator portal.

  2. 02

    Adapt and approve

    Agree processes, responsibilities and approval steps with IT, HR, finance and management.

  3. 03

    Put it into use

    Explain the rules to staff, check implementation and update the policy as circumstances change.

Business outcome

A practical basis to discuss, approve and implement instead of repeated generic statements. Account, data and payment risks connect to responsible people and verifiable rules.

CYBERPOL

Your policy should make the employee’s next action clear.

CYBER-BRO / Incident Response

Report an incident.

Do not send passwords, secret keys or personal data databases. Briefly describe the situation.