An acceptable use policy (AUP) is a document that sets out how an organisation's IT systems and devices may be used. It tells everyone who uses them what they are expected to do, and not do, with the network, computers, email and internet. Without one, staff would have to guess what counts as reasonable use, and the organisation would have no written rule to point to when someone behaved badly.
An AUP is part of an organisation's wider information security policy, the whole set of documents about keeping systems and data safe. Rules on passwords, backups and virus protection sit alongside it. The AUP is the part that deals with people's everyday behaviour, which matters because many security incidents start with a person's mistake.
An AUP helps reduce internal threats from inside the organisation. Accidental internal threats are mistakes by someone who means no harm, such as emailing a file to the wrong contact. Malicious internal threats are deliberate, such as an employee copying a customer list before moving to a rival. It also helps reduce external threats, because outside attackers often get in through a weakness a member of staff leaves open, such as reading a login code aloud to a caller pretending to be from the IT team.
By making the rules clear, an AUP protects the organisation from staff misusing IT, stealing data, sharing confidential information, damaging its reputation, introducing malware and acting as a security weakness. Clear rules also give the organisation grounds to act when they are broken.
For example, a small karting circuit keeps records of who has booked and takes photos of customers at the track. If an employee posted a photo of a customer's crash on social media, the AUP would not physically stop them, but it would show they had broken a written rule, so the circuit could investigate and act. Honest staff also know where the boundary lies.
An AUP is not the same as an acceptable software policy: the software policy covers installing and using software, while the AUP covers how people behave when using IT systems.
An acceptable use policy (AUP) is divided into sections. The scope and assets sections set the boundaries for everything that follows: who the rules apply to, and what the rules protect.
The scope states who must follow the policy. It usually covers every employee, whatever their role, as well as managers, temporary and agency staff, contractors and volunteers. Visitors who are handed temporary login details may be included too. Depending on the organisation, the scope may cover the whole business or just one site, department or team.
The scope can also name the systems it covers, such as the payroll system, the staff intranet and the files kept on the shared drive, along with any personally owned device that connects to them. This matters because a policy that does not say who it applies to cannot be enforced against anyone.
The assets section lists the equipment, documents and knowledge that the policy protects.
Naming the assets matters for two reasons. It tells staff exactly what they must protect, so nobody assumes the rules only cover the equipment they happen to be sitting at. It also shows the organisation what it holds and how valuable each asset is, so it can decide how much protection each one needs. A client contact database needs far more protection than a box of blank name badges.
An acceptable use policy (AUP) is a document that sets out how staff are expected to behave when they use an organisation's digital systems — its computers, network, email and internet connection. Everyone signs the same rules, so it is clear what counts as sensible use. It is not the same as an acceptable software policy, which deals with installing software.
Staff must keep their login details to themselves. Sharing a password, even with a trusted colleague, means the system can no longer tell who did what, so someone could see or change files they are not allowed to. Passwords must be changed regularly so an old leaked password stops working. A strong password — long, with a mix of letters, digits and symbols — is much harder to guess or crack than a short one.
Screens should lock automatically after a short period of inactivity, and staff should sign out at the end of a session. An unlocked login lets the next person read confidential information, such as client notes or bank details.
A wallpaper file from a fan site can hide malicious code, so staff should not download files from the internet without IT approval. A memory stick from home can carry malware, so connect only organisation-issued removable media. Work equipment should not be used for streaming films, shopping online or personal email, because these tasks add more chances for malicious adverts or links to appear.
Opening a website with offensive jokes or rude images can make nearby colleagues uncomfortable, so sites like these are banned. Cyberbullying — for example, repeatedly excluding a colleague from a team chat or adding mocking emojis — is banned because it can make someone feel isolated and anxious. If equipment is damaged or stolen, report it to the service desk straight away so it can be repaired or replaced and, if stolen, its account disabled and files wiped remotely.
The unacceptable section of an acceptable use policy (AUP) lists the behaviours that are never allowed when staff use the organisation's IT. It matters because staff need to see exactly where the boundary sits, and the organisation needs a rule written down before it can act on a breach.
| Forbidden behaviour | Why it is a problem |
|---|---|
| Opening a customer's order history, or a colleague's file, out of curiosity rather than for a task | Unauthorised access breaks data protection law, and the organisation can be fined or sued |
| Emailing a supplier contract or a staff record to a personal account, or printing it at home | The data leaves the organisation's control, where it cannot be watched over, backed up or protected |
| Taking a work laptop or tablet off site without permission, or leaving it on show in a parked car | The device and its files leave the protected network, and a thief takes every file with it |
| Using work systems for illegal activity, including viewing illegal material | Police involvement, serious damage to reputation, and the internet service can be cut off |
| Posting about a named customer, a colleague or the business itself on social media | It identifies people without their consent and can harm the organisation's reputation |
A rule such as 'staff must not copy customer orders to a personal device or personal cloud account' can be checked and enforced. A rule such as 'staff must be careful with data' cannot, because nobody can say for certain whether it has been broken.
For example, a bakery chain might write: 'Staff must not look up a customer's order history unless they are handling that customer's order or complaint.' Someone browsing a celebrity's cake orders has plainly broken it, so the organisation can point to the exact sentence it relies on.
An acceptable software policy explains what an organisation does to help prevent the installation and use of unapproved software. Any program on a computer could contain a weakness an attacker can use, so the policy controls what software is allowed and how it gets onto the devices. It is not the same as an acceptable use policy, which covers how staff behave online rather than what software sits on the devices.
Users are usually forbidden from installing software or even updates themselves, because a helpful-looking tool can still be a risk. If someone needs something new, they either choose from an approved list or make a request. On the request they must justify why the job cannot be done without it — for example, a designer at a print firm explaining that a client sends artwork in a format the current program cannot open. An IT manager then considers the request, checking the licence cost and whether the program fits the existing setup before approving or refusing it.
| Risk | How the policy helps |
|---|---|
| Unlicensed software on machines | Only approved programs are installed, and approval checks the licence, so the organisation avoids legal action and fines. |
| Security software being changed or switched off | Staff cannot install tools that disable anti-virus or firewall settings, making unauthorised access harder. |
| Software used for the wrong reasons | Approved programs are for work tasks only, which reduces copyright breaches and misuse of the organisation's software. |
| Viruses being brought in | Fewer unapproved installs mean fewer chances to introduce a virus. Training also helps staff recognise phishing emails and malicious links, so they do not download and run a harmful file by mistake. |
Operating system safeguards support the policy: where a user account has no administrative rights, the operating system simply refuses to install new software.
The monitoring section of an acceptable use policy explains how an organisation checks and records whether staff are following the rules. Monitoring does not stop an action happening; it gathers evidence of what staff have already done, so their behaviour can be compared with the policy.
| Method | What it records | Why it is used |
|---|---|---|
| Content or word filters | Scans email, downloads and web pages for chosen words, file types or addresses, then reports what staff accessed. | A filter can flag an email containing a customer's bank details, so the organisation can check whether data was sent outside. |
| Browsing history and network traffic | Websites visited, time spent online, and how the internet connection is used. | Unusual sites or large downloads show whether the network is being used for personal activity or to move files. |
| CCTV or direct observation | Office cameras, or a manager walking round, seeing what staff are doing at their screens. | Shows whether staff are spending time on things the policy forbids, or whether a visitor has wandered into an office area. |
| Scanning storage areas | Checks the drives and folders staff use for files that should not be there. | Finds photos, films or music saved on work equipment, which the policy may forbid and which wastes storage space. |
| Access logs | Who logged in, when, from which device, and which files they opened. | Lets the organisation trace an action back to one account, such as a file being opened late at night. |
| Monitoring software or screen sharing | Software that records what is on a screen, or lets IT look at a screen while someone works. | Lets the organisation see what a member of staff is doing as it happens, rather than only after the event. |
Blocking websites is not monitoring. Blocking stops a page from opening, so it controls behaviour rather than checking it, and it leaves no record of what a member of staff has done. Monitoring checks and records behaviour, so there is evidence that can be compared with the policy.
The sanctions section of an acceptable use policy (AUP) sets out what happens when a member of staff, or anyone else the policy covers, breaks the rules. It defines the process that will be followed and the penalties that can be applied, so nobody is treated unfairly or surprised.
The process usually starts informally with a quiet word. If the behaviour continues or is serious, it moves through formal stages, so the penalty matches how serious the behaviour was. A formal case normally begins with a disciplinary hearing: a meeting where the evidence is presented, the member of staff can explain what happened, and a decision is made.
Fines and legal action are not sanctions on the staff member. A fine or a court case is aimed at the organisation, for example from a regulator or a customer, and any police case is separate and is not run by the organisation.
The section matters because staff know the consequences before they break a rule, so the organisation can act consistently and staff cannot claim they did not realise how serious the behaviour was.
The agreement section is where a person acknowledges that they have read the acceptable use policy and agree to follow it. Until someone agrees, the AUP is only a document sitting on a shelf; it does not show that anyone has accepted the rules.
On a paper AUP, the person signs their name. On a digital version, they tick or click a box, for example when they first log on or when they open the policy in an online staff handbook. A digital version is quicker to collect and easier to store and check, but a tick box is still a valid way of acknowledging the policy.
The date of agreement is recorded, so the organisation knows when the person agreed and which version of the policy was current at that time. When the policy is updated, staff must agree to the new version, and the date shows who has already done so and who still needs to.
A paper AUP is often countersigned by a more senior person, such as a line manager. The countersignature verifies that the signature is genuine and shows that a named senior person has seen the document, so the member of staff cannot later claim they never signed it.
| Paper AUP | Digital AUP |
|---|---|
| Signed by hand | Tick or click a box |
| Often countersigned by a senior person | Date and version stored automatically |
Agreement is what makes the policy enforceable. Because the member of staff has agreed, and the date is recorded, they cannot say they did not know the rules, so the sanctions section can be used. For the organisation, the signed or ticked agreement is evidence that staff were told what was expected of them. For example, a catering company updates its AUP on its staff intranet; when you log on, a box asks you to agree, and the system records the date and version beside your name.