Scope and assets of an acceptable use policy

An acceptable use policy (AUP) is divided into sections. The scope and assets sections set the boundaries for everything that follows: who the rules apply to, and what the rules protect.

Scope

The scope states who must follow the policy. It usually covers every employee, whatever their role, as well as managers, temporary and agency staff, contractors and volunteers. Visitors who are handed temporary login details may be included too. Depending on the organisation, the scope may cover the whole business or just one site, department or team.

The scope can also name the systems it covers, such as the payroll system, the staff intranet and the files kept on the shared drive, along with any personally owned device that connects to them. This matters because a policy that does not say who it applies to cannot be enforced against anyone.

Assets

The assets section lists the equipment, documents and knowledge that the policy protects.

• Equipment includes laptops, tablets, phones, printers, servers, network equipment and removable storage such as USB drives.
• Documents include client records, contracts, invoices, designs, staff records and reports.
• Knowledge covers what staff know, such as trade secrets, recipes, formulas, plans and ideas that give the organisation an advantage.

Naming the assets matters for two reasons. It tells staff exactly what they must protect, so nobody assumes the rules only cover the equipment they happen to be sitting at. It also shows the organisation what it holds and how valuable each asset is, so it can decide how much protection each one needs. A client contact database needs far more protection than a box of blank name badges.