Cyber security policies and procedures
- Policies in the set: six core, plus one for each 1 above
- 9
- Hours to draft the whole set
- 27
- Hours a year to keep it reviewed
- 14
- First-year cost of the set at your hourly figure
- $1,822.50
Every figure on this page is computed from the inputs entered, by the method stated below it. Hardenvo publishes no security standard, no coverage ratio and no legal rule: the ratios, the hours and the costs are yours, and the defaults are a worked example to replace with your own figures.
The figures above start from a worked example (9). Change any input and the answer updates as you type.
Download the Cyber security policies and procedures worked example (CSV)
This is a cyber security policies and procedures sheet, the sizing arithmetic that comes before anyone writes a word. Every organisation that takes security seriously ends up with a core set, an acceptable use policy, a password and access policy, a data handling policy, an incident response procedure, a backup and recovery procedure and a vendor access policy, and the set grows by one for each fact that is true of you: people working remotely, card payments taken, health information held, personal devices used for work. The sheet counts the set from those facts, multiplies by your own drafting and review figures, and prices the first year at your own hourly cost. Every figure is yours; the sheet publishes no standard and no template text. Free, on the page, no account; the paid plan generates the documents themselves and files each one with a review date.
Why the set is counted before it is written
Twelve people and eight systems with logins do not need a fifty-document manual; they need the six core policies and whichever conditional ones their facts add. On the worked example cards are taken, people work remotely and personal devices are in use, so the set is nine. Counting first stops the two usual failures: the blank page that never becomes a policy at all, and the borrowed fifty-policy binder nobody in a twelve-person organisation will ever read.
The cost nobody budgets
Nine policies at three drafting hours each is 27 hours before anyone reviews anything, and at 90 review minutes per policy the set asks for another 13 hours or so every year it stays alive. At $45 an hour the worked example prices the first year at about $1,800 of someone's time. The figures are all inputs: change the hours and the rate to yours, and the sheet reprices the set as you type.
What the sheet does not do
It does not write the policies, cite a law or a framework, or tell you whether a regulator, an insurer or a customer contract will accept the set. Whether nine policies satisfy your insurer is your adviser's question; the sheet gives you the count, the hours and the cost to bring to that conversation. The paid plan generates the documents from your facts and keeps the review dates.
Cyber security policies and procedures: common questions
What are cyber security policies and procedures?
The written rules an organisation runs its security by: a policy says what must happen (passwords are unique, backups run nightly), a procedure says how and who (the incident response steps in order, the name that restores the backup). The free sheet on this page counts the set your facts call for and what it costs to draft and keep, from figures you enter, with no account.
How many policies does a small organisation need?
The sheet counts six core policies for everyone, acceptable use, passwords and access, data handling, incident response, backup and recovery, and vendor access, and adds one each for remote working, card payments, health information and personal devices where you say the fact is true of you. On the worked example that is nine. It is a count of documents, not a legal opinion.
Does Hardenvo write the policies for me?
The free sheet sizes the set; Hardenvo Pro generates each document from the facts you enter, your organisation's name, systems and choices, files it with a status and a review date, and reminds you before a review passes. Whether the wording satisfies a law, a standard or an insurer stays your adviser's call, and the documents say so on their face.
Hardenvo Pro
Keeping what you make
The sheets are free forever. Pro turns them into the record: every policy and plan generated against your organisation's own facts, review dates filed with a status, your name and logo on the printed documents, no watermark, and an export when the insurer, the bank or the board asks.
- Download as PDF
- No Hardenvo watermark
- Save every document and reopen it later
- Your organisation's name and logo on the paperwork
- Export every policy and plan in one go
- Email review reminders before a policy goes stale
- Connect your own Stripe account
- Connect QuickBooks or Xero
$29per month, whole team
Start Hardenvo Pro PricingRenews monthly at the price above until you cancel. We email you before any price change.
Cite or embed this figure
Cyber security policies and procedures (Policies in the set: six core, plus one for each 1 above): 9, Hardenvo, worked example.
Cite as: "Cyber security policies and procedures, Hardenvo", updated 2026-09-04, https://hardenvo.com/tools/cyber-security-policies-and-procedures/.