Information Security Plan for SMEs: How to Design It in 5 Phases

1. Introduction

The Information security plan is the most important document an SME can commission in cybersecurity, and at the same time the least understood. While large corporations have been managing security with methodology for decades, most small and medium businesses operate with loose measures: an antivirus, an office firewall and plenty of trust. An Information security plan properly designed transforms that improvisation into a system: identified assets, prioritized risks, approved policies and a budget you can defend to the board.

In this article we explain how to design an Information security plan in five phases, using the real document structure we apply in projects for industrial, logistics and services clients. You do not need to be an expert to follow it: each phase includes deliverables, decision criteria and typical mistakes to avoid. If your company needs a serious Information security plan proportional to its size, here is the complete roadmap.

2. What the Information security plan is and why your SME needs it

An Information security plan is the set of documents and decisions that define how an organization protects its assets: what it protects, against which threats, with which controls, with which budget and with which owners. It is not paperwork to obtain a certificate: it is the operational foundation of the company’s cybersecurity. Without a plan, every security decision is made in a hurry; with a plan, every decision is made by criterion.

SMEs need it for three concrete reasons. First, because 43 % of cyberattacks worldwide target companies with fewer than 500 employees, according to annual industry reports. Second, because more and more customers and public administrations require security evidence to sign contracts or access subsidies. Third, because an Information security plan demonstrates due diligence: if an incident happens, the company with a plan has a legal defence, and the one without it stands alone against the claim.

Let us use a realistic example: a 30-employee distribution company suffers a ransomware attack. Without a plan, the decision to pay is made in an emergency meeting, without knowing what to restore first. With a plan, the crisis committee knows that the asset inventory is in the repository, that the backups were tested the previous Friday and that an incident response provider is already contracted. The difference between both scenarios is not luck: it is the design work done in advance.

The Information security plan is also the prerequisite for everything else: ISO 27001 certification, ENS compliance in the public sector, properly applied GDPR or the NIS2 directive for operators in critical sectors. If your security provider sells you tools before a plan, change provider.

3. Phase 1: Scope and context of the organization

The first phase answers one question: which part of the organization falls inside the plan? The scope can be the whole company or a specific process (invoicing, customer service, production), but it must be decided with criteria: an overly ambitious scope makes the plan unmanageable, and an overly narrow one makes it irrelevant. In the Information security plan projects we lead, 80 % of SMEs choose the full scope with proportional controls, except those with critical industrial processes.

Context also includes the applicable legal and sector obligations, the expectations of customers and providers, and the requirements of the value chains where the company operates. All of it is documented in the first section of the plan and conditions the rest of the design. A detailed context analysis usually reveals requirements the company did not know it had, such as contractual security clauses in existing customer agreements.

This is also the phase where the governance model is decided: who approves the policies, who executes them and who supervises compliance. In SMEs without a security department, governance usually falls on three roles: the IT manager executes the controls, a board member approves the policies and an external party supervises compliance. That separation of duties is what gives the plan credibility with customers and insurers.

4. Phase 2: Asset inventory and risk analysis of the Information security plan

You cannot protect what you do not know. The second phase builds the information asset inventory: systems, applications, data, people and dependencies on third parties. Each asset is characterized by its criticality (the impact of its loss or alteration) and by its confidentiality, integrity and availability rating. This inventory is the backbone of the Information security plan: without it, any later control is decorative.

With the inventory closed, the risk analysis is performed. For private companies without regulatory obligations we recommend a light methodology such as the risk management inventory of ENISA, with three steps: identify the relevant threats for each asset, estimate probability and impact, and order the risks in a priority matrix. The result is the risk register, which determines which controls of the plan are essential and which can wait. An example of a minimal register would be:

Asset	Threat	Probability	Impact	Priority
Mail server	Targeted phishing	High	High	Critical
Invoicing ERP	Internal / external fraud	Medium	High	High
Customer data	Data breach (GDPR)	Medium	High	High
Office Wi-Fi	Unauthorized access	Low	Medium	Medium

Fig. 1 – Example of a risk register from an Information security plan for SMEs.

The analysis must be repeated every year, not because the threat catalogue changes, but because assets change: every new SaaS application or sales channel alters the risk map.

To keep the register objective, we recommend numerical criteria from the start: probability and impact on a scale of 1 to 5, with written definitions for each level. That way, two people reach the same result when valuing the same asset. The tool can be a shared spreadsheet; what matters is the consistency of the criterion.

5. Phase 3: Policies, controls and document structure

The third phase turns the prioritized risks into concrete policies and controls. Policies define the expected behaviour (passwords, access, device use, incident management) and controls verify it. This is the document structure we recommend for an SME Information security plan:

5.1. Document structure of the Information security plan

security-plan/
├── 01-scope/
│   ├── scope-and-context.md
│   └── governance-and-owners.md
├── 02-assets/
│   ├── asset-inventory.csv
│   └── criticality-assessment.md
├── 03-risks/
│   ├── risk-register.md
│   └── treatment-plan.md
├── 04-policies/
│   ├── information-security-policy.md
│   ├── password-policy.md
│   ├── access-policy.md
│   └── device-policy.md
├── 05-controls/
│   ├── iso27001-controls-matrix.md
│   └── audit-evidence/
├── 06-budget/
│   └── security-budget.xlsx
└── 07-review/
    ├── security-indicators.csv
    └── action-plan-2027.md

Fig. 2 – Document structure of an Information security plan for SMEs.

So that policies are operational and their approval is auditable, we recommend giving them a formal header like the following, which records owner and version:

<?xml version="1.0" encoding="UTF-8"?>
<policy id="ISMS-POL-001" version="1.2">
  <title>Password policy</title>
  <scope>All staff with access to corporate systems</scope>
  <approved_by>Board of directors</approved_by>
  <approval_date>2026-09-27</approval_date>
  <reviewed>annually</reviewed>
</policy>

Fig. 3 – Formal header of a policy inside the Information security plan.

Every policy must be brief, approved by management and reviewed annually. A common mistake is copying policies from generic templates: an Information security plan that does not reflect the real operations of the company becomes dead paper that nobody reads or applies. Policies must name real tools, processes and people of your organization.

As for controls, the implementation priority must follow the order of the risk register, not the technological fashion: first multi-factor authentication on email and administrative access, then verified backups and network segmentation, and only at the end monitoring tools. It is the order we follow in the Information security plan projects we direct, and it delivers visible results within the first six months.

6. Phases 4 and 5: Budget, implementation and review

Phase four translates controls into euros: the annual security budget. Phase five defines implementation, the calendar and the review mechanism, and closes the loop of the Information security plan. To give you a sense of the figures, these are the ranges we manage in real Information security plan projects for SMEs in 2026:

Company size	External services	Software and licences	Training	Indicative total / year
1-10 employees	€2,500-4,500	€800-1,500	€400-800	€3,700-6,800
11-50 employees	€5,000-10,000	€2,000-4,000	€1,200-2,500	€8,200-16,500
51-150 employees	€12,000-25,000	€5,000-9,000	€3,000-6,000	€20,000-40,000
151-300 employees	€25,000-50,000	€10,000-18,000	€6,000-12,000	€41,000-80,000

Fig. 4 – Indicative annual budget of an Information security plan by company size.

Implementation is organized in monthly sprints with assigned owners and a semi-annual review date. The review plan includes three activities: annual internal audit, risk register review and action plan update. Without review, any Information security plan ages in less than a year; with review, it becomes the management instrument that the board really needs.

As a reference, in our projects the complete document usually takes between six and twelve weeks of joint work. Half the time goes to the inventory and risk phases, where the organization is really understood; the other half, to writing applicable policies and preparing implementation. If someone offers you a full plan in two weeks, be suspicious: either it is an off-the-shelf template, or they have not understood your business. The most widespread reference framework for structuring the plan and its controls is the NIST Cybersecurity Framework.

7. Conclusion

Designing an Information security plan for your SME does not require a security department or a million-euro budget: it requires method, and that method is exactly what we have broken down in these five phases. Start with the scope, know your assets, prioritize your risks, write policies that can actually be followed and reserve budget to review them every year.

At Jaymon Security we help SMEs design, write, implement and audit their complete Information security plan, using methodologies such as ISO 27001 and MAGERIT, with a team that combines technical depth and the ability to communicate with management.

Need help with Information security plan?

At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.