Acceptable Use Policy

An Acceptable Use Policy (AUP) establishes clear expectations for how organizational resources — including computers, networks, email, internet access, cloud services, mobile devices, and data — may be used. The policy typically covers permitted and prohibited activities, personal use guidelines, data handling requirements, password and authentication expectations, software installation rules, remote work requirements, social media guidelines, and the consequences of policy violations. By setting explicit boundaries, an AUP helps prevent security incidents caused by negligent or uninformed user behavior, which remains one of the most common vectors for security breaches.

ISO 27001 Annex A control A.5.10 specifically addresses acceptable use of information and other associated assets, requiring that rules for the acceptable use and handling of information be identified, documented, and implemented. SOC 2's Common Criteria require organizations to communicate policies and expectations to personnel, and the AUP is a primary vehicle for this communication. NIS2's requirements for basic cyber hygiene practices and cybersecurity training align with the AUP's role in defining expected user behavior. In technology due diligence, the existence and enforcement of an AUP demonstrates that the organization has established behavioral standards for information security.

An effective AUP must balance security requirements with practicality and usability. Overly restrictive policies that are routinely ignored or worked around are worse than balanced policies that are consistently followed. The policy should be written in plain language (avoiding excessive legal or technical jargon), kept to a reasonable length, and focused on the behaviors that matter most for security. All employees should acknowledge the AUP during onboarding, and periodic re-acknowledgment (typically annual) ensures ongoing awareness. The AUP should be reviewed and updated regularly to address new technologies, emerging threats, and changes in working practices — the rapid adoption of generative AI tools, for example, has prompted many organizations to update their AUPs with guidelines on the use of AI services with organizational data.