Acceptable Use Policy
Also known as: AUP, computer acceptable use policy, network use policy, IT acceptable use policy
An Acceptable Use Policy (AUP) is a written document that sets out the permitted and prohibited uses of an organization's IT systems, networks, devices, email, and internet access.
It establishes the rules users must agree to follow as a condition of access and defines the consequences of violations. A well-written AUP covers personal use of company equipment, prohibited content and activities, data handling expectations, monitoring rights, and incident reporting obligations.
Acceptable Use Policy, explained at three levels
At home
When you start a new job and agree to the IT terms and conditions, you are usually signing an acceptable use policy: a document that says what you can and cannot do with the company's computers, internet, and email. Common rules include not using work email for personal business, not downloading unlicensed software, and not accessing inappropriate websites on the company network. Agreeing to these rules protects both you and the employer.
At work
An AUP is a legal and operational document that defines the boundaries of permitted technology use and establishes your organization's rights to monitor, audit, and enforce those boundaries. It is typically a condition of employment and systems access. A legally sound AUP should state clearly what monitoring the organization conducts, identify prohibited activities with sufficient specificity to be enforceable, and outline the disciplinary process for violations. HR and legal should review the AUP before it is finalized.
At home
An AUP typically covers: permitted use (work-related use is the primary purpose; incidental personal use may or may not be allowed), prohibited activities (accessing illegal content, circumventing security controls, sharing credentials, unauthorized software installation), monitoring rights (the organization can monitor traffic, email, and device activity on its systems), data handling (how sensitive data must be treated on personal vs company devices), incident reporting (users must report suspected security incidents promptly), and consequences (disciplinary action up to termination and legal prosecution).
At work
Remote working and BYOD have significantly complicated AUP scope. When employees use personal devices for work, the AUP must address which activities on personal devices are subject to organizational policy and what monitoring, if any, extends to personal devices. Many organizations use mobile device management (MDM) to separate work data from personal data on personal devices and make clear in the AUP that by enrolling a personal device the user consents to management of the work container.
At home
From an employment law standpoint, the AUP is a key document in disciplinary proceedings involving technology misuse. For disciplinary action to succeed, the employer typically needs to demonstrate that the policy was communicated, the employee acknowledged it, the prohibited activity is clearly covered, and the monitoring evidence was obtained within the policy's stated scope. Courts have generally upheld employer monitoring rights when employees have been clearly informed of those rights.
At work
From a practitioner standpoint, the most common AUP failures are: policies not updated in years (missing cloud services, AI tools, remote work rules), policies too vague to enforce ('use good judgment' is not enforceable), and inadequate distribution processes. An effective AUP review cycle aligns with the annual IT security review, ensures legal counsel validates enforceability in relevant jurisdictions, and tracks acknowledgement rates: 100% annual re-acknowledgement is a SOX ITGC and ISO 27001 control.
Real-world examples
At home
Nadia started a new job at an insurance firm and was asked to read and sign the AUP as part of onboarding. She noticed the policy prohibited using work email for personal shopping and required her to report suspected phishing emails within two hours. When she received a suspicious email three months later, she knew exactly what to do.
At work
The IT security team at Greenfield Bank reviewed their AUP after an employee was found storing client data in a personal Dropbox account. The existing policy did not mention personal cloud storage. The updated AUP specifically prohibited storing work data in non-approved cloud services, required annual re-acknowledgement, and triggered an HR process for non-acknowledgement after 30 days.
Common confusions
- An AUP is not a privacy policy. A privacy policy is a public-facing document that tells customers how the organization collects and uses their personal data. An AUP is an internal document that tells employees and system users what they may and may not do. They address different audiences and serve different legal purposes.
- Having an AUP does not mean monitoring is automatically lawful in every jurisdiction. In some countries and US states, monitoring of employee communications requires additional notice, consent, or conditions beyond what an AUP alone provides. Organizations with employees in the EU must ensure that any monitoring is necessary, proportionate, and transparent under GDPR.
- An AUP is only effective if it is enforced consistently. An organization that disciplines one employee for a policy violation while ignoring the same violation by others faces unfair treatment claims and creates the impression that the policy is selectively applied. HR, IT, and legal must align on the escalation process for common violations before they occur.
For analysts
In BA artefacts, the AUP creates constraints that affect system design: particularly around monitoring capabilities, data classification requirements, and access logging. When documenting requirements for a new system, check whether it must generate audit logs sufficient to support AUP enforcement (user access records, data export logs, activity monitoring). Requirements for BYOD-capable systems should specify what MDM enrollment and monitoring capabilities are needed to stay within the AUP's scope. Useful NFR: 'The system must generate user activity logs for all data access and export events, retained for a minimum of 90 days, to support AUP enforcement and forensic investigation.'
History & origin
Acceptable use policies trace their origins to early academic and government networks. The National Science Foundation's Acceptable Use Policy for the NSFNET backbone (1992) was one of the earliest formal examples, restricting use to research and educational activities and explicitly prohibiting commercial use. As internet access expanded to businesses in the mid-1990s, organizations formalized their own AUPs to manage employee internet use. The rise of personal devices, cloud services, remote work, and AI tools has made AUPs more complex over time.