Every blank you fill appears in the document as you type. Click a highlighted blank to jump to its field.
Fill in the blanks
0 of 5
The preview updates as you type.
Acceptable Usage Policy
Acceptable Usage Policy
Company Name
Effective Date
Policy Owner
Approved By
IT Department Head
1. Purpose & Scope
(a)This policy defines the acceptable use of the Organization's information technology resources, including computer systems, networks, email, internet access, and software applications. It establishes the standards of behavior expected of all users to protect organizational assets.
(b)This policy applies to all employees, contractors, consultants, temporary workers, and any other individuals who are granted access to the Organization's IT resources, regardless of their location or the device used to access those resources.
(c)The IT Department Head shall be responsible for the implementation, communication, and enforcement of this policy, including the monitoring of compliance and the investigation of reported violations.
2. Acceptable Use Standards
(a)Organization IT resources are provided primarily for business purposes. Limited personal use is permitted provided it does not interfere with work duties, consume excessive bandwidth, or violate any provision of this policy.
(b)Users shall protect their authentication credentials, including passwords and multi-factor authentication tokens, and shall not share these credentials with any other person. Users are accountable for all activity conducted under their credentials.
(c)Users shall not install, download, or execute unauthorised software, browser extensions, or applications on Organization-owned devices without prior written approval from the IT department.
3. Prohibited Activities
(a)Users shall not use Organization IT resources to access, download, store, or distribute material that is illegal, obscene, defamatory, discriminatory, harassing, or otherwise offensive. This includes but is not limited to pornographic material, hate speech, and pirated software.
(b)Users shall not attempt to gain unauthorised access to any system, network, account, or data to which they have not been granted access. This includes probing or testing the security of systems without explicit written authorisation from the IT department.
(c)Users shall not use Organization IT resources for commercial activities unrelated to the Organization's business, political campaigning, religious proselytising, gambling, or any activity that could bring the Organization into disrepute.
4. Monitoring & Privacy
(a)The Organization reserves the right to monitor, log, and audit the use of its IT resources to ensure compliance with this policy, detect security threats, and investigate suspected violations. Users should have no expectation of privacy when using Organization systems.
(b)Monitoring shall be conducted in a manner that is proportionate, lawful, and consistent with applicable privacy legislation. The Organization shall not target individual users for monitoring without reasonable cause and appropriate management authorisation.
(c)Monitoring logs and audit records shall be retained for a minimum of 12 months and shall be accessible only to authorised IT security personnel, management, and Legal Counsel on a need-to-know basis.
5. Enforcement & Policy Review
(a)Violations of this policy shall result in disciplinary action proportionate to the severity of the violation, up to and including termination of employment and referral to law enforcement where criminal conduct is involved.
(b)Users who become aware of any violation of this policy, or who suspect that Organization IT resources have been compromised, shall report the matter immediately to the IT Help Desk or the Information Security team.
(c)This policy shall be reviewed at least annually by the IT Department Head in consultation with the Information Security team and Legal Counsel. All users shall acknowledge acceptance of any material amendments.
The guide
Everything you need to know about the acceptable usage policy
What Is an Acceptable Usage Policy?
An acceptable usage policy, often called an AUP, sets the rules for how employees may use company technology, including computers, networks, email, internet access, and software. It defines permitted and prohibited activities, expectations around security and personal use, and the consequences of misuse. The policy protects company systems and data by making clear, before any incident occurs, exactly what responsible use of company resources looks like for every employee.
Why Companies Need an Acceptable Usage Policy
Company devices and networks are constant targets for security threats, and careless use is a leading cause of breaches and data loss. An AUP reduces this risk by setting clear behavioral rules, from password practices to what may not be downloaded or shared. It also protects the company legally by defining boundaries around harassment, illegal content, and confidentiality. When rules are written and acknowledged, enforcement is fair and employees cannot claim they were unaware.
What an Acceptable Usage Policy Should Include
State the scope: which devices, networks, accounts, and users are covered. List acceptable and prohibited uses, including rules on personal use, downloading software, accessing inappropriate content, and sharing confidential data. Cover security expectations such as passwords, device locking, and reporting suspicious activity. Address monitoring, making clear the company may review usage of its systems, and the use of personal devices. End with the consequences of violations and a requirement for employees to acknowledge the policy.
That depends on your policy, but most companies allow limited, reasonable personal use as long as it does not interfere with work, consume excessive resources, or breach security rules. State clearly what limited personal use means so expectations are unambiguous.
In most jurisdictions employers can monitor use of company-owned systems, but the policy should disclose this clearly so employees have no reasonable expectation of privacy on those systems. Transparency about monitoring also strengthens your legal position and builds trust.
Yes, if employees access company data or networks from personal phones or laptops, the AUP or a companion BYOD policy should set security requirements for those devices. This ensures company information stays protected even when it lives on hardware the company does not own.
Ready to get started?
Create an account and send your first screening link today. The free plan gives you 10 credits a month, with no card needed.
