Purpose of an acceptable use policy

An acceptable use policy (AUP) is a document that sets out how an organisation's IT systems and devices may be used. It tells everyone who uses them what they are expected to do, and not do, with the network, computers, email and internet. Without one, staff would have to guess what counts as reasonable use, and the organisation would have no written rule to point to when someone behaved badly.

An AUP is part of an organisation's wider information security policy, the whole set of documents about keeping systems and data safe. Rules on passwords, backups and virus protection sit alongside it. The AUP is the part that deals with people's everyday behaviour, which matters because many security incidents start with a person's mistake.

Reducing threats

An AUP helps reduce internal threats from inside the organisation. Accidental internal threats are mistakes by someone who means no harm, such as emailing a file to the wrong contact. Malicious internal threats are deliberate, such as an employee copying a customer list before moving to a rival. It also helps reduce external threats, because outside attackers often get in through a weakness a member of staff leaves open, such as reading a login code aloud to a caller pretending to be from the IT team.

What it protects against

By making the rules clear, an AUP protects the organisation from staff misusing IT, stealing data, sharing confidential information, damaging its reputation, introducing malware and acting as a security weakness. Clear rules also give the organisation grounds to act when they are broken.

For example, a small karting circuit keeps records of who has booked and takes photos of customers at the track. If an employee posted a photo of a customer's crash on social media, the AUP would not physically stop them, but it would show they had broken a written rule, so the circuit could investigate and act. Honest staff also know where the boundary lies.

An AUP is not the same as an acceptable software policy: the software policy covers installing and using software, while the AUP covers how people behave when using IT systems.