# IT policies for small business [Read the public page](https://www.adarkcloud.com.au/services/it-policies) Write practical IT policies around your business accounts, devices and data. Perth based policy support with remote workshops across Australia. IT policy work turns the way your business uses accounts, devices and information into clear operational rules. We can help draft and review those rules from Perth, with remote discussions across Australia. Legal, privacy and industry advice remain with the appropriate advisers. Perth based, with remote support across Australia. From $79 an hour ex GST, with the fee agreed before work begins. Call Josh C on 0408 530 303. ## What we can help with - Current practice and responsibility review - Scoped operational policy drafting - Account and device usage rules - Staff guidance and acknowledgement process - Policy owner and review record A policy should help a staff member decide whether they can share a file, install an app or use a personal device for work. Copying a large organisation's document can leave those ordinary questions unanswered. Begin with the tools people already use and the decisions your business needs them to make consistently. ## Use current practice as the starting point We discuss where staff work, which accounts they use and how business records are shared. Contractors, personal devices and remote work may need specific rules. A short review can identify which policies are worth writing first. Each document should have a defined audience and a clear connection to how the business operates. ## Make account and access rules understandable Staff need to know how accounts are requested, who approves access and what happens when someone leaves. Administrator access and recovery information need particular ownership. The policy should match the technical process. A rule requiring individual accounts is incomplete if the business still expects everyone to use the same password for a shared system. ## Set boundaries for devices and information We can scope acceptable use, device care and approved storage or sharing methods. Rules should explain what happens when equipment is lost or a business file is sent to the wrong person. Sensitive information may have legal or contractual requirements. We identify those dependencies for the appropriate adviser rather than treat an operational policy as a legal conclusion. ## Describe how new tools are approved Staff may introduce cloud apps or use AI accounts before a formal decision has been made. The policy should name who approves a tool and what information can be used with it. A useful rule distinguishes an approved task from permission to connect the whole customer database. The related account settings and staff guidance should support that boundary. ## Make incident reporting practical A person who suspects an account problem needs a contact and a route that still works if email access is lost. The policy can explain what information to record and which decisions require escalation. It should also connect to the actual incident plan and provider responsibilities. An emergency contact that nobody maintains is weak preparation. ## Give the policy an owner and a review point The handover can include the policy draft, implementation gaps and a staff acknowledgement process. Your business approves the rules and assigns the person responsible for keeping them current. Remote workshops and document reviews can suit businesses across Australia. Perth site discussions, legal review and specialised industry requirements are established separately in the scope. ## Common questions ### Can the policies be short? Yes. They should be detailed enough to guide the relevant decisions. A short document with clear responsibilities can be more useful than a long template nobody follows. ### Do you provide legal advice? No. We can help with operational IT rules and identify questions for your legal, privacy or industry adviser. Their review should be scoped where the requirement needs it. ### Do policies make us compliant with SMB1001? Policies may support particular requirements, but the selected standard and certification process determine what is needed. A policy document alone does not establish certification or compliance. ### Can you review our existing documents remotely? Yes. We can compare them with current systems and agreed working examples through remote discussions across Australia, then identify revisions and implementation gaps. ## Useful next steps - [SMB1001 preparation](https://www.adarkcloud.com.au/services/smb1001-support) - [Managed security](https://www.adarkcloud.com.au/services/managed-security) - [AI governance](https://www.adarkcloud.com.au/services/ai-governance) - [Backups and recovery](https://www.adarkcloud.com.au/services/backups-and-security) - [ASD small business cyber security handbook](https://www.cyber.gov.au/publication/small-business-cyber-security-handbook) - [A practical AI use policy for a small business](https://www.adarkcloud.com.au/blog/is-your-team-using-chatgpt-at-work-ai-policy) Reviewed 2026-10-08 - [Ask for IT help](https://www.adarkcloud.com.au/contact) - [Check your IT basics](https://www.adarkcloud.com.au/tools/it-health-check)