ICT Policies: Writing Rules Your Staff Will Actually Read

I have a confession. I have read a great many ICT policies over the years, and I have finished perhaps two. Most were forty pages long, copied from a multinational, full of phrases like "the organisation shall endeavour to leverage", and filed in a folder that nobody has opened since the day it was signed. Meanwhile, the Wi-Fi password is written on the whiteboard and everyone uses the same login for the accounts system. A good ICT policy for businesses in Kenya does not need to be long. It needs to be read.

Why most ICT policies fail

The typical policy fails for the same reasons a long WhatsApp message fails: too many words, not enough point. It is written to protect the company on paper rather than to help staff make good decisions in real life. It describes rules without explaining why, and it covers technology the office does not even use.

Njoroge, who manages a mid-sized insurance agency, found this out when he asked his team about the policy they had all signed. Most remembered signing it. One remembered it had a blue cover. Nobody could name a single rule in it.

Writing an ICT policy for businesses in Kenya that works

Start with your real risks, not a template. What would actually hurt your business? Usually it is losing client data, money stolen through fake emails, a device lost with sensitive files on it, or a former employee who still has access. Write rules that address those, in plain language.

• Keep it short, ideally a few pages, with a one-page summary at the front

• Use plain English or Swahili, whichever your team reads comfortably

• Explain the reason behind each rule in one sentence

• Use real examples from your office, not abstract scenarios

• Say clearly who to contact when something goes wrong

A rule like "Do not share passwords, because if something goes wrong we cannot tell who did it, and it might be blamed on you" lands far better than "Credential sharing is strictly prohibited".

What the policy should cover

For most small and medium businesses, a handful of topics covers the important ground.

• Passwords and two-factor authentication on key accounts

• Company devices: care, loss and what may be installed

• Personal phones used for work email or WhatsApp groups

• Handling client and staff personal data, in line with the Data Protection Act 2019

• Email safety, including how to spot fake payment requests

• Backups and where work files must be saved

• Reporting incidents quickly, without fear of punishment

• What happens to access and devices when someone leaves

The personal data section deserves care. Kenya's Data Protection Act 2019 sets out obligations for anyone handling personal information, and the Office of the Data Protection Commissioner oversees compliance. Your policy does not need to quote the law, but it should make sure staff know how to treat customer and employee data responsibly. Systems that control who sees what, such as HR and payroll software with proper access controls, make that much easier to follow in practice.

Make it part of everyday life

A policy that lives in a drawer does nothing. Walk new staff through the one-page summary during onboarding, ideally with chai and mandazi to keep attention alive. Put the key rules on a poster near the printer, where everyone waits anyway. Send a short reminder when something relevant happens, like a scam doing the rounds.

Most importantly, make it safe to report mistakes. If someone clicks a dodgy link and is afraid of being shouted at, they will hide it, and a small problem becomes a large one. Thank people who report quickly. That culture matters more than any clause.

Review it every year

Technology and your business both change. Set a date each year to read the policy again, remove anything outdated, and add anything new. If you have moved to cloud tools, started accepting online payments or allowed remote work, the policy should say so.

Your next step: write the one-page summary first, before anything else. If you cannot fit your most important rules on a single page, your staff will never remember them either. And please, take the Wi-Fi password off the whiteboard.