Government oversight and litigation has driven the need for proper IT Policies and Procedures even in Small to Mid-size businesses.  The need for policies and procedures seems to be growing each year.  Because of this it is best to have at least some basics covered for these things.

Because of this you need to have Policies / SOPs in place to show that you are actively managing your digital information:

Policy: a guideline of action or form of conduct expected by employees in a company. A guideline of action on how to guide a decision and reach an expect outcome.

Procedure: an official way of doing something in the company that conforms with existing policies. 

SOP: a standard procedure for employee on how to do something. The purpose is to create a step by step instruction on performing a task or responding to an incident. Which will create an effective and consistent outcome by following the SOP.

Recommended Policies and SOPs:

Suggested Policies:
* Acceptable Use Policy – AUP
* Password Policy
* Backup Policy
* Network Access Policy
* Incident Response Policy
* Remote Access Policy
* Virtual Private Network (VPN) Policy
* Guest Access Policy
* Wireless Policy
* Third Party Connection Policy
* Network Security Policy
* Encryption Policy
* Confidential Data Policy
* Data Classification Policy
* Mobile Device Policy
* Retention Policy
* Outsourcing Policy
* Physical Security Policy
* E-mail Policy

Suggested SOP:
* How to respond to a cyber breach / hacker attack / data incident?
* How to cancel or transfer an employee digital / network access when they no longer work at the company. 
* How to put on hold an employee digital / network access for employee on leave for more than ___ days.

Document Service Companies for making Policies / Procedures and SOPs:

Trainual – good for small to enterprise size companies