Corporate security policies

Minimum: password manager, unique 12+ char passwords, MFA on email and critical systems. Ban 'one password everywhere' and shared accounts.

Own devices: PIN/biometrics required, disk encryption, remote wipe of corporate data on exit, work/personal separation.

Who reports to whom within 1 hour: lost laptop, phishing email, data leak. 'No punishment for reporting' — otherwise people hide incidents.

Least-privilege: access only to what's needed. Offboarding — revoke access on exit day. Quarterly rights audit.

NDA before access, minimal data, separate accounts without admin rights, mandatory check of the SaaS vendor's incident history.

One page per policy: purpose, scope, rules (5–7 items), owner, yearly review. Nobody reads 20 legal pages.