Guides › Does my small business need a written information security plan?
Does my small business need a written information security plan?
When a small business or startup needs a written information security plan: state laws, cyber insurance, and customer security questionnaires. What to include and how to write one fast.
If your business keeps personal information about customers or employees, there's a good chance someone will ask for your written security plan. It might be a state law, a cyber insurer, or a large customer. Here's how to tell, and what the plan should say.
When a written plan is required or expected
State law. Massachusetts requires any business that holds personal information about Massachusetts residents to have a written information security program (201 CMR 17.00), wherever the business is located. Several other states require "reasonable security" for personal data, and a written plan is the usual way to show it.
Financial services. If you offer financial products or services (tax prep, bookkeeping, lending, some auto dealers), the FTC Safeguards Rule requires a written program.
Cyber insurance. Applications commonly ask whether you have written security policies, an incident response plan, and multi-factor authentication.
Customers and investors. Startups selling to larger companies get security questionnaires. "Do you have a documented information security policy?" is almost always on them.
What to include
A small business plan doesn't need to be long. It needs to be accurate:
- Who is responsible for security
- What sensitive data you keep (customer records, payment details, employee files) and where
- Who can access it, with multi-factor authentication and prompt removal when people leave
- How devices are protected: updates, encryption, screen locks, lost-device steps
- Which vendors handle your data and how you chose them
- Employee training and acceptable use rules
- What you do in an incident, with names and phone numbers
- When you review the plan
The FTC's guide Protecting Personal Information: A Guide for Business and NIST's small business cybersecurity resources are good free references.
The fast way
WispMint asks about 10 minutes of plain questions about your business, or you describe it in a sentence and AI fills in the answers. It builds your plan on the FTC and NIST small business guidance and state laws like Massachusetts 201 CMR 17.00, and shows a free readiness score before you pay.
WISP Instant is $49. Business Pro ($199/year) adds 8 more documents insurers and customers ask for: an incident response policy, risk assessment, vendor register, and policies for acceptable use, passwords and access, data retention, remote work, and security training.
Frequently asked questions
We're five people. Is this overkill?
No. A five-person company can have a three-page plan. What matters is that it's written, true, and followed.
Can I copy a template from the internet?
You can, but a template describes someone else's business. Insurers and customers notice generic answers, and a plan that doesn't match how you work won't help in an incident.
Will this pass a customer security review?
It gives you the documents most questionnaires ask for. Some enterprise reviews also want certifications like SOC 2, which are a separate, larger project.
Build your security plan in 10 minutes
Answer plain-English questions, see your free security score, and download a plan built from IRS Publication 5708 and the FTC Safeguards Rule, or FTC and NIST guidance for other businesses. From $49.
Start free See a sample plan