-- particles

What Should Be Included in an Acceptable Use Policy?

Every business should have an acceptable use policy so that employees know what the permitted uses of company computers and networks are. Without a clear policy, they don’t know what’s allowed or not. The results can include overuse of resources, bad security practices, and friction between managers and employees. Everyone should understand where the boundaries are.

General restrictions

Certain activities should always be prohibited. They include:

  • Illegal activities, including fraud, threats, and harassment.

  • Spamming by email or any other channel.

  • Making unauthorized representations on behalf of the employer.

  • Circumventing device and network security.

  • Introducing malicious software, such as spyware, worms, and ransomware.

  • Disclosing confidential information, except as permitted in one’s job.

  • Revealing account passwords to anyone else.

  • Actions prohibited by company policies.

Software policies

A company should carefully consider whether and to what extent employees will be allowed to install software. Giving them blanket permission to install software on their assigned machines opens up security risks. A common approach is to allow only authorized IT people to install software on employees’ machines.

BYOD and telecommuting policies

The policy should specify whether employees may use their own devices on the company network. This includes telecommuting as well as smartphones and tablets.

If employees can use personal mobile devices on the network, the AUP needs to specify what security measures are required. This may include installing company-mandated software to separate business and personal use. The policy needs to make it clear that any monitoring applies only to the business side of employee-owned devices and personal use is private.

If the policy allows telecommuting, it should require the use of a VPN and protection of the account associated with it.

Social media and time sinks

The company’s policy on using social media, watching videos, and other potentially time-wasting activities will depend on the business culture and the network’s ability to absorb the bandwidth. Some companies need to be very strict, prohibiting nearly all non-business use. Others will trust their employees not to abuse their privileges.

A policy shouldn’t be so strict that it interferes with necessary work activities. A blanket prohibition on watching video could interfere with work-related education and research. A strict policy should allow usage for purposes that are part of doing one’s job. A few companies have such stringent security requirements that they have to prohibit all nonessential activity; they’re a special case which is beyond the scope of this article.

At the other end, there should always be rules to limit clearly excessive usage. Even a lenient policy should state that social media use is acceptable only if it doesn’t interfere with the employee’s work duties, isn’t detrimental to the employer, and doesn’t involve unauthorized claims to speak for the employer. The company’s policies on trademarks, harassment, discrimination, and so on should be incorporated by reference.


The policy needs to explain how it will be enforced. There are several points it needs to cover.

  • If user activity is monitored, even just occasionally, the AUP needs to say so. If some areas, such as the content of email, are protected from monitoring, it should say that also. Making this point clear protects the employer from ill will and possibly from legal action.

  • The consequences should be made clear with a phrase such as “up to and including termination.”

  • The policy should explain the procedures in case of a suspected violation. The employee should have an opportunity to answer charges of misuse.

The SANS Institute has published an acceptable use policy template, which businesses may freely adapt for their own use. Each business has to consider its own needs and make whatever changes are necessary to fit them.

Please contact us if you need more information or help.

Related Posts

Four Technologies You Can Use to Better Protect Your Data in Transit

Encryption Implementing strong encryption protocols works to secure data during transmission. From a technical point of view: SSL/TLS (Secure Sockets Layer/Transport Layer Security) protocols are commonly used to encrypt communication between a user's browser and a website. This added encryption ensures that any information exchanged is secure and cannot be easily intercepted by people looking to...

Insurance Companies Are Asking My Business About Its Cybersecurity. What’s the Deal?

You might have noticed that business insurance companies are starting to show an interest in how you are protecting your technology and data. If your org has been in touch with your insurance provider regarding modifying or renewing your business insurance, you were likely handed a lengthy questionnaire about your cybersecurity. Let’s take a look together to help you make informed decisions on how...

Tip of the Week: Making Your Network VoIP-Friendly

We could go on and on about the benefits of using Voice over Internet Protocol (also known as VoIP) for your business telephone needs. However, it is important that you do everything you can to prepare your network for this kind of utilization. Let’s review a few tips to help make sure your network is properly optimized for VoIP. How to Prepare Your Network for a VoIP Implementation Ensure You...

Critical Security Measures for Data Privacy

In an individual sense, at least, it?s relatively simple. You don?t want to share anything more than what you need to. However, there is also something to be said for security and its relationship with privacy, and whether or not you should sacrifice one to maintain the other. You don?t have to pick one; in fact, you should be using security to protect your data privacy. Today, we?re investigating...