Acceptable use policy

An acceptable use policy (AUP) is a document that sets out how staff are expected to behave when they use an organisation's digital systems — its computers, network, email and internet connection. Everyone signs the same rules, so it is clear what counts as sensible use. It is not the same as an acceptable software policy, which deals with installing software.

Rules that protect access

Staff must keep their login details to themselves. Sharing a password, even with a trusted colleague, means the system can no longer tell who did what, so someone could see or change files they are not allowed to. Passwords must be changed regularly so an old leaked password stops working. A strong password — long, with a mix of letters, digits and symbols — is much harder to guess or crack than a short one.

Screens should lock automatically after a short period of inactivity, and staff should sign out at the end of a session. An unlocked login lets the next person read confidential information, such as client notes or bank details.

Rules that protect the network

A wallpaper file from a fan site can hide malicious code, so staff should not download files from the internet without IT approval. A memory stick from home can carry malware, so connect only organisation-issued removable media. Work equipment should not be used for streaming films, shopping online or personal email, because these tasks add more chances for malicious adverts or links to appear.

Rules that protect people

Opening a website with offensive jokes or rude images can make nearby colleagues uncomfortable, so sites like these are banned. Cyberbullying — for example, repeatedly excluding a colleague from a team chat or adding mocking emojis — is banned because it can make someone feel isolated and anxious. If equipment is damaged or stolen, report it to the service desk straight away so it can be repaired or replaced and, if stolen, its account disabled and files wiped remotely.