A suspicious email does not need to look obviously fraudulent to cause trouble. It may appear to come from a supplier, the ATO, Microsoft 365, a director or a staff member whose account has been compromised. Knowing how to create a phishing policy gives your team clear instructions before someone is faced with a convincing message and has to make a quick decision.
For a small or medium-sized business, the goal is not to create a lengthy cybersecurity document that sits unread in a folder. A useful policy should help people recognise concerns, report them quickly and avoid making a small mistake worse. It should also give managers and IT support a consistent way to respond.
Start with the business risks you actually face
A phishing policy should reflect how your organisation works. A medical practice handling patient information has different risks from a construction business approving supplier invoices, while a law firm may be targeted with fraudulent document-sharing emails or fake settlement requests.
Think about the actions an attacker would want a staff member to take. Common examples include entering Microsoft 365 credentials on a fake sign-in page, opening a malicious attachment, changing a supplier's bank details, buying gift cards after receiving an email that appears to be from a director, or sending sensitive information to the wrong person.
This exercise keeps the policy practical. Rather than telling staff simply to “be careful”, you can explain the situations that matter most to your business. Review recent suspicious emails, invoice processes, payroll procedures and the systems staff access remotely. Your managed IT provider can also help identify common attacks targeting your industry.
Define what your phishing policy covers
Your policy should apply to more than emails. Phishing can arrive through text messages, phone calls, social media messages, QR codes, shared documents and compromised business accounts. Staff need to understand that a familiar name or logo is not proof that a request is legitimate.
Set out who the policy applies to, including permanent staff, casual employees, contractors and anyone with access to company email or systems. Clarify that it covers both office and remote work, as well as personal devices where they are approved for business use.
A concise policy normally includes these core areas:
- the types of suspicious messages and requests staff may receive
- the checks required before sharing information, approving payments or changing banking details
- the process for reporting a suspected phishing attempt
- the immediate steps to take if a link is clicked, credentials are entered or an attachment is opened
- the responsibilities of managers, finance staff and IT support during an incident
Keep the wording clear enough that a new starter can understand it without needing technical knowledge. A policy works best when it answers, “What do I do next?”
How to create a phishing policy with clear reporting steps
The reporting process is the most valuable part of the document. Staff should never feel embarrassed about reporting a suspicious email, even if it turns out to be harmless. Early reports can prevent a single message from becoming a wider incident.
Tell staff exactly where to send suspicious messages. This may be a dedicated reporting button in Microsoft 365, a nominated internal email address or a call to your IT support contact. Avoid vague instructions such as “notify IT”. In a real situation, people need a specific action.
Your policy should ask staff not to forward suspicious emails in the usual way, as this can make technical investigation harder or accidentally spread a harmful attachment. Instead, explain the reporting method your business uses. If the message appears to be from an internal colleague, staff should verify unusual requests through a known phone number, Teams message or face-to-face conversation, not by replying to the suspicious email.
It is also worth spelling out what information to include in a report: the sender, the time received, what action was taken and whether any details were entered. This allows IT support to assess the risk quickly.
Make payment and bank-detail changes a separate rule
No email policy alone can remove payment fraud risk. Criminals regularly impersonate suppliers, executives and accounts staff to redirect payments. Your phishing policy should reinforce a separate verification process for bank-detail changes, unusual invoices and urgent payment requests.
For example, require finance staff to call the supplier using a phone number already held in your accounting system or obtained from an established source. Do not use the contact details included in the email requesting the change. The extra few minutes can prevent a significant loss.
The same principle applies to requests from directors or managers. An urgent request is not a reason to skip normal approval processes.
Explain what to do after a mistake
A good policy does not punish someone for reporting an error promptly. People may hesitate if they fear blame, and that delay gives an attacker more time to access accounts, send emails internally or steal data.
State clearly that staff should report immediately if they clicked a suspicious link, opened an attachment, entered a password, approved an unexpected sign-in prompt or shared information. They should contact the nominated support person straight away and, where instructed, disconnect the device from Wi-Fi or the network. They should not attempt to fix the problem themselves by deleting emails or changing settings unless guided by IT.
Your IT response process may include resetting passwords, ending active sign-in sessions, checking mailbox rules, reviewing affected devices and warning other staff. The policy does not need to explain every technical step, but staff should know that speed and honesty are expected.
Support the policy with sensible technical controls
Staff awareness matters, but it should not be the only line of defence. People are busy, and well-crafted phishing messages are designed to exploit normal workplace habits. Technical controls reduce the chance that a single mistake leads to an account takeover or financial loss.
For most businesses, this includes multi-factor authentication for email and cloud services, email filtering, regular software updates, secure backups and access permissions that match each person’s role. Microsoft 365 security settings can also help flag suspicious sign-ins, block risky attachments and reduce spoofed email.
There are trade-offs. Very strict email filtering can occasionally hold legitimate messages, particularly from new suppliers or clients. The right approach is to tune the controls, review quarantined messages and give staff a safe way to request help when an expected email has not arrived. Security should support work, not make it unnecessarily difficult.
Train for real decisions, not just annual compliance
Phishing training is more effective when it is short, regular and relevant. An annual presentation may meet a compliance requirement, but staff are more likely to remember a two-minute reminder after seeing a realistic example of a fake invoice or Microsoft 365 sign-in alert.
Include phishing awareness in induction for new staff, then revisit it throughout the year. Use examples that reflect the tools and processes your team uses. A receptionist may need guidance on suspicious delivery messages, while an accounts manager needs confidence to challenge a bank-detail change.
Simulated phishing tests can be useful, but they need to be handled carefully. Their purpose is to identify gaps and improve awareness, not catch people out. Share the lesson from the test, recognise improvement and update training where a pattern emerges.
Assign ownership and review the policy
A phishing policy needs an owner. In a smaller business, this may be the operations manager, practice manager or director working with an IT provider. That person should ensure staff receive the policy, training is completed and contact details remain current.
Review the document at least annually and whenever your business changes email platforms, finance processes, key suppliers or remote-work arrangements. Also review it after a real phishing incident or near miss. These events often show where instructions were unclear or controls did not match the way staff work.
Keep the final policy accessible. Staff should be able to find it quickly in your onboarding material, shared document area or employee handbook. A one-page quick-reference guide can sit alongside the full policy, particularly for reporting steps and payment verification.
A phishing policy is not about expecting staff to spot every scam perfectly. It is about creating a workplace where people pause, verify and report concerns early, while the business has practical safeguards ready behind them.
