Legal and Ethical
Acceptable Use Policies
Contents
An acceptable use policy (AUP) is a document that sets out how an organisation's IT systems and devices may be used. It tells everyone who uses them what they are expected to do, and not do, with the network, computers, email and internet. Without one, staff would have to guess what counts as reasonable use, and the organisation would have no written rule to point to when someone behaved badly.
An AUP is part of an organisation's wider information security policy, the whole set of documents about keeping systems and data safe. Rules on passwords, backups and virus protection sit alongside it. The AUP is the part that deals with people's everyday behaviour, which matters because many security incidents start with a person's mistake.
Reducing threats
An AUP helps reduce internal threats from inside the organisation. Accidental internal threats are mistakes by someone who means no harm, such as emailing a file to the wrong contact. Malicious internal threats are deliberate, such as an employee copying a customer list before moving to a rival. It also helps reduce external threats, because outside attackers often get in through a weakness a member of staff leaves open, such as reading a login code aloud to a caller pretending to be from the IT team.
What it protects against
By making the rules clear, an AUP protects the organisation from staff misusing IT, stealing data, sharing confidential information, damaging its reputation, introducing malware and acting as a security weakness. Clear rules also give the organisation grounds to act when they are broken.
For example, a small karting circuit keeps records of who has booked and takes photos of customers at the track. If an employee posted a photo of a customer's crash on social media, the AUP would not physically stop them, but it would show they had broken a written rule, so the circuit could investigate and act. Honest staff also know where the boundary lies.
An AUP is not the same as an acceptable software policy: the software policy covers installing and using software, while the AUP covers how people behave when using IT systems.
An acceptable use policy (AUP) is divided into sections. The scope and assets sections set the boundaries for everything that follows: who the rules apply to, and what the rules protect.
Scope
The scope states who must follow the policy. It usually covers every employee, whatever their role, as well as managers, temporary and agency staff, contractors and volunteers. Visitors who are handed temporary login details may be included too. Depending on the organisation, the scope may cover the whole business or just one site, department or team.
The scope can also name the systems it covers, such as the payroll system, the staff intranet and the files kept on the shared drive, along with any personally owned device that connects to them. This matters because a policy that does not say who it applies to cannot be enforced against anyone.
Assets
The assets section lists the equipment, documents and knowledge that the policy protects.
- Equipment includes laptops, tablets, phones, printers, servers, network equipment and removable storage such as USB drives.
- Documents include client records, contracts, invoices, designs, staff records and reports.
- Knowledge covers what staff know, such as trade secrets, recipes, formulas, plans and ideas that give the organisation an advantage.
Naming the assets matters for two reasons. It tells staff exactly what they must protect, so nobody assumes the rules only cover the equipment they happen to be sitting at. It also shows the organisation what it holds and how valuable each asset is, so it can decide how much protection each one needs. A client contact database needs far more protection than a box of blank name badges.
The unacceptable section of an acceptable use policy (AUP) lists the behaviours that are never allowed when staff use the organisation's IT. It matters because staff need to see exactly where the boundary sits, and the organisation needs a rule written down before it can act on a breach.
What is ruled out, and the risk it creates
| Forbidden behaviour | Why it is a problem |
|---|---|
| Opening a customer's order history, or a colleague's file, out of curiosity rather than for a task | Unauthorised access breaks data protection law, and the organisation can be fined or sued |
| Emailing a supplier contract or a staff record to a personal account, or printing it at home | The data leaves the organisation's control, where it cannot be watched over, backed up or protected |
| Taking a work laptop or tablet off site without permission, or leaving it on show in a parked car | The device and its files leave the protected network, and a thief takes every file with it |
| Using work systems for illegal activity, including viewing illegal material | Police involvement, serious damage to reputation, and the internet service can be cut off |
| Posting about a named customer, a colleague or the business itself on social media | It identifies people without their consent and can harm the organisation's reputation |
Make every rule specific
A rule such as 'staff must not copy customer orders to a personal device or personal cloud account' can be checked and enforced. A rule such as 'staff must be careful with data' cannot, because nobody can say for certain whether it has been broken.
For example, a bakery chain might write: 'Staff must not look up a customer's order history unless they are handling that customer's order or complaint.' Someone browsing a celebrity's cake orders has plainly broken it, so the organisation can point to the exact sentence it relies on.
The monitoring section of an acceptable use policy explains how an organisation checks and records whether staff are following the rules. Monitoring does not stop an action happening; it gathers evidence of what staff have already done, so their behaviour can be compared with the policy.
Ways behaviour is monitored
| Method | What it records | Why it is used |
|---|---|---|
| Content or word filters | Scans email, downloads and web pages for chosen words, file types or addresses, then reports what staff accessed. | A filter can flag an email containing a customer's bank details, so the organisation can check whether data was sent outside. |
| Browsing history and network traffic | Websites visited, time spent online, and how the internet connection is used. | Unusual sites or large downloads show whether the network is being used for personal activity or to move files. |
| CCTV or direct observation | Office cameras, or a manager walking round, seeing what staff are doing at their screens. | Shows whether staff are spending time on things the policy forbids, or whether a visitor has wandered into an office area. |
| Scanning storage areas | Checks the drives and folders staff use for files that should not be there. | Finds photos, films or music saved on work equipment, which the policy may forbid and which wastes storage space. |
| Access logs | Who logged in, when, from which device, and which files they opened. | Lets the organisation trace an action back to one account, such as a file being opened late at night. |
| Monitoring software or screen sharing | Software that records what is on a screen, or lets IT look at a screen while someone works. | Lets the organisation see what a member of staff is doing as it happens, rather than only after the event. |
Blocking websites is not monitoring. Blocking stops a page from opening, so it controls behaviour rather than checking it, and it leaves no record of what a member of staff has done. Monitoring checks and records behaviour, so there is evidence that can be compared with the policy.
The sanctions section of an acceptable use policy (AUP) sets out what happens when a member of staff, or anyone else the policy covers, breaks the rules. It defines the process that will be followed and the penalties that can be applied, so nobody is treated unfairly or surprised.
The process usually starts informally with a quiet word. If the behaviour continues or is serious, it moves through formal stages, so the penalty matches how serious the behaviour was. A formal case normally begins with a disciplinary hearing: a meeting where the evidence is presented, the member of staff can explain what happened, and a decision is made.
Sanctions the organisation can apply
- A verbal or written warning. A written warning is kept on the person's file and used if the behaviour continues.
- Further training, where the problem was a lack of knowledge, such as not knowing how to report a data breach.
- Demotion or a reduction in pay, moving the person to a less senior job or lowering their pay.
- Suspension, sending the person home for a set period, sometimes without pay.
- Termination of employment, dismissing the person, for severe or repeated breaches.
Fines and legal action are not sanctions on the staff member. A fine or a court case is aimed at the organisation, for example from a regulator or a customer, and any police case is separate and is not run by the organisation.
The section matters because staff know the consequences before they break a rule, so the organisation can act consistently and staff cannot claim they did not realise how serious the behaviour was.
The agreement section is where a person acknowledges that they have read the acceptable use policy and agree to follow it. Until someone agrees, the AUP is only a document sitting on a shelf; it does not show that anyone has accepted the rules.
How agreement is shown
On a paper AUP, the person signs their name. On a digital version, they tick or click a box, for example when they first log on or when they open the policy in an online staff handbook. A digital version is quicker to collect and easier to store and check, but a tick box is still a valid way of acknowledging the policy.
The date of agreement is recorded, so the organisation knows when the person agreed and which version of the policy was current at that time. When the policy is updated, staff must agree to the new version, and the date shows who has already done so and who still needs to.
A paper AUP is often countersigned by a more senior person, such as a line manager. The countersignature verifies that the signature is genuine and shows that a named senior person has seen the document, so the member of staff cannot later claim they never signed it.
| Paper AUP | Digital AUP |
|---|---|
| Signed by hand | Tick or click a box |
| Often countersigned by a senior person | Date and version stored automatically |
Why agreement matters
Agreement is what makes the policy enforceable. Because the member of staff has agreed, and the date is recorded, they cannot say they did not know the rules, so the sanctions section can be used. For the organisation, the signed or ticked agreement is evidence that staff were told what was expected of them. For example, a catering company updates its AUP on its staff intranet; when you log on, a box asks you to agree, and the system records the date and version beside your name.