Insights into building inclusive hiring and policy practices

November 24, 2025 | Cybersecurity
Chloe Schofield

Written by
Chloe Schofield

When it comes to inclusion and policy best practices, organisations can find it challenging to know where to start, how to get it right, and the steps they should take to achieve their goals.

I recently joined GTIA’s Global Women in Tech (GWIT) webinar on inclusive hiring and policy development. It was a great session that offered plenty to take away from. In this article, I share what resonated the most from the session.

1. Start with your ‘why’

Every inclusive policy needs to start with an honest question … why are we doing this?

Often, inclusion initiatives are drafted solely to meet compliance requirements or to keep pace with industry expectations. But if policies are created without a clear and genuine reason, they tend to fade into the background and eventually become redundant.

When motivation is genuine and rooted in an organisation’s values and people, the outcome becomes meaningful, which results in a more sustainable and trusted policy.

One key recommendation was to utilise the ‘Five Whys’ method when developing policy. By repeatedly coming back to ‘why,’ organisations are far more likely to uncover the root motivation for a policy. It’s a powerful way to move beyond surface-level intentions and get to the heart of what you want to achieve.

2. Use AI thoughtfully

AI is everywhere, and it comes with both benefits and pitfalls for policy creation. Tools like ChatGPT can be incredibly helpful for getting started, such as structuring drafts, generating ideas, or creating first versions of policy documents. However, the main thing to remember is that AI should be used thoughtfully, providing the ‘bare bones’ to get started with a policy.

When using AI, it’s important to refine and humanise any AI-generated material by consulting internal teams and examining the tone and language, as well as how closely it aligns with your culture and brand. Validating it with directly impacted groups is also a key step.

3. Consult and collaborate

The most effective policies are co-created ones. Engaging employee resource groups (ERGs) or connecting with trusted individuals who bring lived experience are great ways to develop policies that will meet your needs.

When covering sensitive topics, it’s important to seek consent before involving anyone and creating feedback loops so input can evolve. Testing policies with small groups before rolling them out widely also leaves the door open for continued dialogue. The most inclusive policies are those that are open to change and ongoing involvement.

4. Make policies accessible and human

We’ve all encountered policies where it’s difficult to understand what exactly is being said, or that are full of legal jargon that only a lawyer would understand – but policies should feel like they’re written for people. Accessible policies should be able to be understood by every individual it is relevant to, so it’s crucial to consider the language used when creating a policy and reflect on who is going to need to use and understand it.

To achieve a policy that’s accessible, use a conversational tone that reflects your company’s ethos and culture. Including real-world examples and scenarios, using gender-neutral language such as ‘they/them’ and considering the inclusion of a trans-inclusion statement are also top tips to creating an accessible policy.

4. Menopause and menstrual health policies

Menopause and menstrual health policies are still rare, yet they’re deeply needed.

The session highlighted how these policies don’t just support those directly affected; they also educate allies, destigmatise vital conversations, and signal that an organisation cares about its employees as individuals, not just their job titles. Menopause and menstrual health policies should be inclusive of trans and non-binary individuals and come with educational content for managers and colleagues.

Referencing organisations like Menopause Friendly UK and Stonewall for guidance on best practices was a key recommendation from the discussion.

6. Legal vs. lived experience

Legal compliance is non-negotiable, but it’s not enough when it comes to creating inclusive policies. True inclusion is about balancing the legal obligations with the real life and lived experiences of employees. Policy manuals shouldn’t read like a contract – they need to be empathetic, engaging and relevant, bringing humanity to an organisation.

7. Considerations for small businesses

Even for small businesses or those that are not directly affected, inclusive policies matter. They communicate readiness, empathy and show that you care.

If internal expertise is limited, leveraging the expertise of external HR consultants or peer networks is a great option. What matters most is showing that you care enough to plan ahead and demonstrate that inclusion isn’t about the size of a business, it’s about mindset.

8. Review and reiterate

Inclusion isn’t a ‘set and forget’ task. Policies need to evolve as things change from both internal and external factors. Scheduling annual reviews, refreshing language, and recommunicating policies regularly is important, as well as tracking usage, gathering feedback, and treating each revision as an opportunity to reaffirm values.

What’s important to remember is that inclusive policies are not about optics, they’re about outcomes and they’re a declaration of who an organisation are and what they stand for.

When creating inclusive policies, if clarity of purpose is combined with compassion in practice, then we can build environments where people don’t just feel included, they feel seen. Diversity of thought and perspective is vital to resilience; it’s not just a ‘nice-to-have,’ it’s a strategic advantage.

Recommended reading

Cybersecurity Roundup, October 2025

October has seen a series of high-profile cyberattacks affecting global brands and critical services. From ...

From box-ticking to behaviour change: why SMBs need specialist help with cybersecurity training

Cybersecurity training in SMBs often looks good on paper, but does it actually work? Too many businesses ...

Navigating CAF: How Adoptech helps MSPs align with the UK’s Cyber Assessment Framework

For MSPs working with Operators of Essential Services (OES) companies and their supply chains, the UK’s Cyber ...