How To Make an Acceptable Use Policy – Example with Free Template

When working with cyber security, it can be very useful to have both an IT security policy and an Acceptable Use Policy. Both documents work together to provide a clear set of expectations, which will strengthen your security by outlining IT security goals, responsibilities, and requirements for employees. You can use our templates for both policies as guides that can help you get started.

The purpose of an Information Security Policy is to provide a general set of objectives for the organisation to aim for. Additionally, it emphasises that all staff are responsible for maintaining the organisation’s IT security. The policy is a small document with only a few pages, and it serves as a management memo with ambitions for the organisation’s information security measures. The link above will take you to a free template and tutorial for making your own information security policy.

The Acceptable Use Policy (AUP) is more extensive and includes rules and guidelines, which the entire organisation must follow. While the Information Security Policy is general and strategic, the Acceptable Use Policy for security is concrete and actionable.

While the Information Security Policy provides strategic objectives, the Acceptable Use Policy defines specific rules to follow. Basically, it includes what should be incorporated into one’s daily routine while working. For example, it can include guidelines about the length of passwords, safe use of Wi-Fi, clean desks, sending personal data over email, or private use of company equipment, like laptops and smartphones.

The purpose of the AUP is to create the field for the organisation to play on. The AUP should provide clarity to all staff members, so the guidelines should be easy for everyone to understand and follow.

You’ll know that your AUP is successful when nobody in your organisation has to debate whether they are breaking the rules. The guidelines should be really clear in setting out expectations, so that everyone can easily navigate through their daily work life in a secure way. Additionally, the document should be concise, as too many rules can be overwhelming and might ultimately lead to worse information security.

 

         

How to use our Acceptable Use Policy Example

Since every organisation is different, we recommend that our AUP template serves as an example, giving you inspiration for your own policy. Your organisation has its own needs and context that might make only some of the rules relevant. So, we recommend taking what is relevant to you, adding your own guidelines, and removing the rest.

The AUP template contains guidelines on the following topics: 

• Purpose statement

• Confidentiality

• Access codes (passwords and PIN codes)

• Physical security

• Handling of equipment and documents outside of premises

• Equipment and software

• User credentials

• Digital activity

• Security monitoring and logging

• Handling of personal data

• Reporting security incidents

 

Additionally, the AUP template contains two main sections:

• Purpose statement
• Guidelines and principles

 

Guidelines and principles cover 10 focus areas for the rules in your organisation. We will go over each point below, after we discuss the purpose statement.

  

Purpose statement

First, we provide a purpose statement to set the tone and communicate the objectives of the Acceptable Use Policy. Generally, this should state that the document is a set of guidelines that all staff in the organisation are expected to follow. Here is an example:

“X (name of organisation) focuses on ensuring the availability, confidentiality, and integrity of its systems and data. All staff must act in a responsible, ethical, and legal manner. All X staff, consultants, and temporary staff are required to manage knowledge with care and discretion, whether written, electronic, or verbal.

Therefore, the handling of data must be per X’s information security policy and follow the listed guidelines and principles. To ensure this, the staff of X are continuously trained and made aware of topics within cybersecurity and the GDPR with continuous training.” 

In short, the purpose statement lays down the basic rules for the use of IT in your organisation. It should explicitly state the expectations related to your staff’s continuous training and awareness.

  

Guidelines and principles:

The guidelines and principles point out specific rules to follow when using IT systems in your organisation. Here, we have added 10 points you can include with some guiding text.  

  

1. Confidentiality

Confidentially is normally included in employment or project contracts, but it is still useful to state it in the guidelines to emphasise its importance. It states that the organisation expects confidentiality from its employees when it comes to confidential information, e.g., customer information. We give an example here:

“You must handle all of X’s information with discretion and care. Under no circumstances should you access or use information, systems, or networks that are not necessary for your job. Do not share confidential information with colleagues, consultants, or temporary staff who do not have a job-specific need for this information. You may not share confidential information with third parties unless it has a clear business purpose. When working with external parties, they must have signed a declaration of confidentiality."

This section provides recommendations on how employees should handle equipment and files when they are outside of your organisation’s premises, e.g., when working remotely.

Here, you can describe how expectations may differ based on whether the employee is physically in the office. This section mainly focuses on securing your organisation’s IT equipment. We provide an example here:

“If you bring IT equipment outside of X’s premises, it must be secured with a pin or password that ensures a sufficient amount of security against access by unauthorised persons.  When flying, mobile equipment (I.e., laptop and mobile device) and documents must always be carried as hand luggage."

User credentials deal with usernames and passwords that are used for logging in to the organisation’s IT systems. For example, multiple users could share user information and make use of each other’s logins. However, we recommend that you only use your own credentials, so that you do not get into trouble because of the actions of others. We give an example of the guideline here:

“User rights must be respected, therefore only use your own user credentials to log in. Never share your user information with others, including your employer. Misuse of credentials and digital activity can leave digital traces that have a negative impact on X.” 

Here, you can discuss best practices and limitations for digital activity on company-owned equipment. It is important to set realistic expectations, and some of these can include what we normally consider common sense. For example, it would be outrageous to ban visiting specific public websites or checking one’s private emails, but you can limit the level of private consumption during work hours. Needless to say, illegal websites and activity should be banned. However, it is up to your organisation to specify these rules, giving your team some freedom while maintaining boundaries. We provide an example here:

“Please minimise the private use of the Internet and email on X’s equipment. For personal documents, save it locally in a folder on your computer and label it ‘Private.’ Personal data must not be sent by email. Under no circumstances, may work-related online correspondence take place through anonymised communication channels. It is strictly forbidden to use X’s email accounts, computers, tablets, and mobile phones to view pornographic, racist, extremist, or criminal content. When receiving an email, the sender’s email address must be checked before unknown links and documents are opened.” 

The last section of this example can help protect your organisation from phishing attacks, which are one of the biggest security threats that companies face.

The purpose of this section is to communicate that you, as the organisation, can log and monitor your team’s digital activities for security purposes. It does not necessarily mean that the monitoring is routinely done. In this section, it’s important to also communicate that you respect your team’s privacy. By bringing potential monitoring to your staff’s attention, you can encourage them to conduct their digital activities within reason. We provide an example here:

“X respects the individual employee’s privacy and complies with local laws and regulations. However, we reserve the right to log IT use and, in special circumstances, require access to an employee’s email and files.”

Proper handling of personal data is one component of GDPR compliance. Normally, compliance with GDPR requires more elaborate processes than a set of rules in a document for IT use. However, the guidelines are still a place where employees can be made aware of some general requirements to abide by, when handling personal data. These guidelines do not say much about the processes that make your organisation GDPR compliant, but they can create awareness of the importance of handling personal data. We give an example here:

“At X, we are very careful to take good care of and protect the personal information that our customers, members, employees, and partners have entrusted us with. We work continuously to develop and implement secure processes, which must ensure the legal and secure processing of personal data.

The last point is to illustrate the importance of reporting security incidents. As clear communication is the only way to warn and protect everybody else of the incident, it should be required for staff to report safety incidents that they observe or are exposed to. In this section, you can provide examples of what a security incident might involve and to whom incidents should be reported. The important thing is that your team is aware of when to act and who to involve. We give an example here:

“If you suspect a security incident, you must immediately report it to your immediate manager and the IT department.”