Cyber Security Policy for Offices: 14-Clause Checklist and Why It Protects Officers

A written cyber security policy for an office should cover acceptable use, passwords and multi-factor login, how to verify emails, a call-back rule for any change in payment details, a ban on acting on financial requests received only on messaging apps, a named incident nodal officer, CERT-In reporting within 6 hours, 180-day log retention, tested backups, access control, vendor clauses, data retention and a training calendar. It is not just an IT document. It is the first piece of evidence that the institution and its officers took “reasonable security practices” (s.43A, IT Act) and “all due diligence” (s.85, IT Act).

Why a written policy is legal protection, not paperwork

After an incident, the first question from police, auditors or a court is: what had you told your people to do? A policy answers it.

• Section 85, IT Act. Where a company commits a contravention, persons in charge are deemed guilty unless they prove lack of knowledge or all due diligence. “Company” includes any body corporate, firm or association of individuals; for a government department, it depends on the facts. A dated, circulated policy is the core of the diligence file.
• Section 43A, IT Act. A body corporate handling sensitive personal data that is negligent in reasonable security practices must compensate for wrongful loss or gain caused. Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 says reasonable security practices means a comprehensive documented information security programme and policies. An organisation that implements IS/ISO/IEC 27001, or an approved code of best practices, is deemed to comply, provided it is audited by an independent auditor approved by the Central Government at least once a year or on a significant upgrade. Section 43A is omitted from 13 May 2027, when the DPDP Act takes over.
• DPDP Rules, Rule 6. From 13 May 2027, Data Fiduciaries, including government bodies unless exempted, must keep minimum safeguards: encryption or masking, access control, logs, backups and security terms in processor contracts.

A policy does not make an office immune. It shows the duties were taken seriously before the incident.

What the policy should contain: the 14 clauses

1. Acceptable use. Official devices and email for official work; no personal cloud drives or unapproved software.
2. Passwords and multi-factor login. Unique passwords, no sharing, multi-factor authentication on email, ERP, banking and admin accounts.
3. Email verification. Read the sender address letter by letter; ignore the display name; report suspected phishing to IT.
4. Payment call-back rule. No change of vendor bank details and no emailed payment instruction is acted on without a call-back on the number already on file, and senior approval for the first payment to a changed account.
5. Messaging-app financial requests. No request for money, gift cards or financial information received only on WhatsApp, Telegram or SMS is acted on, even if it appears to come from the head of office. Verifying is expected, not discourteous.
6. Incident nodal officer. Name, designation, alternate and a single internal reporting channel available at all hours.
7. CERT-In reporting. Listed incidents reported to CERT-In within 6 hours of being noticed, through the designated point of contact; police complaint in parallel.
8. Logs and clocks. Logs of all ICT systems kept for a rolling 180 days within India (not the 30-day device default); clocks synchronised with NIC or NPL time servers.
9. Backups. Regular backups, at least one copy kept off the main network, and a restore actually tested on a fixed schedule.
10. Access control. Least privilege, role-based access, removal of access on transfer or exit, and periodic review of who has admin rights.
11. Vendor clauses. Confidentiality, security, prompt breach notification, the bank-change procedure, and deletion of data at the end.
12. Data retention. What is kept, for how long, and how it is destroyed; no “anyone with the link” sharing of personal data.
13. Training cadence. Induction, a short quarterly drill and an annual refresher, with attendance kept.
14. Review. Yearly, with a dated record.

How to adopt it in a real office

For a district hospital in Gorakhpur, a practical sequence:

1. Draft it in plain language.
2. Get it approved by the competent authority and issue it as an office order with a number and date.
3. Issue the two most urgent parts (payment call-back and messaging-app ban) as separate one-page standing instructions signed by the head of office.
4. Circulate it, collect acknowledgements and hold a 30-minute briefing; record attendance.
5. Put the nodal officer, CERT-In contact and 1930 helpline on one sheet at every desk handling money or data.

Common mistakes

• Copying a long template full of promises (such as certifications) the office does not meet, which can be used against it.
• No owner. Without a named nodal officer, the policy fails in the first hour.
• Untested backups.
• Vendors left out. Payroll and ERP vendors hold your data too.

Frequently asked questions

Is a cyber security policy legally mandatory?

No single provision says “adopt a policy” for every office. But Rule 8 of the 2011 Rules treats a documented security programme and policies as reasonable security practices, and the CERT-In Directions impose reporting and log duties on government organisations and body corporates. A written policy is how those duties are shown to be met.

Do we need ISO 27001 certification?

Not for every office. Under Rule 8, IS/ISO/IEC 27001 with an annual independent audit is deemed compliance, but other documented measures can also be reasonable.

Who should approve the policy?

The competent authority under the institution’s rules, with a dated record of approval.

How often should it be reviewed?

At least once a year, and after any major incident.

Quick quiz

To train the officers who will own this policy: Cyber Crime Law for Offices and Institutions, ₹599. It is a certificate of completion, not a professional qualification.

Sources

• Information Technology Act, 2000: ss.43A, 70B(6), 70B(7), 85
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011: Rule 8
• CERT-In Directions under s.70B(6), dated 28 April 2022
• Digital Personal Data Protection Act, 2023: s.44(2); DPDP Rules, 2025: Rule 6

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.