How to write an acceptable use policy

What an AUP is for

The acceptable use policy is the document every employee actually signs. It sets the ground rules for using company systems, devices, networks and data — and gives you a basis to act when someone crosses the line. It is one of the first documents an auditor requests and a cornerstone of onboarding.

What to include

Scope — who and what it applies to (staff, contractors, devices, accounts).
Acceptable use — what systems are for, and reasonable personal use if you allow it.
Prohibited use — illegal activity, circumventing controls, installing unauthorised software, sharing credentials.
Data handling — link to your classification rules; no company data in unsanctioned tools.
AI tools — whether and how generative AI may be used with company data (an increasingly expected section).
Monitoring — what the organisation monitors, stated transparently for GDPR.
Consequences — what happens on violation, linked to your disciplinary process.

Common mistakes

A wall of legalese no one reads; keep it plain and signable.
No mention of AI tools, now a real data-leak vector.
Promising monitoring you don't perform — or performing monitoring you never disclosed.

Framework alignment

Maps to ISO 27001:2022 Annex A 5.10 (acceptable use of information and assets) and supports SOC 2 and NIST CSF Protect.

Primary sources

ISO/IEC 27001:2022 — Annex A control 5.10, acceptable use of information and other associated assets (iso.org/standard/27001).
NIST — Cybersecurity Framework (CSF) (nist.gov/cyberframework).
ANSSI — guide d'hygiène informatique (ssi.gouv.fr).

Generate it in minutes

See a sample acceptable use policy or generate yours free.

Frequently asked questions

How does an acceptable use policy differ from other security policies?

The AUP is the document every employee signs at onboarding. It sets behavioural ground rules for using company systems, devices and data, and gives you a basis to act on violations. More technical policies (access control, encryption) govern systems; the AUP governs people.

Should an acceptable use policy cover AI tools?

Yes — it is now an expected section. State whether and how generative AI may be used with company data, since pasting confidential information into public tools is a real data-leak vector. Link to a dedicated AI acceptable use policy if you have one.

Can an AUP authorise employee monitoring?

It can, but you must disclose it transparently for GDPR. State exactly what is monitored and why. Never promise monitoring you do not perform, and never perform monitoring you never disclosed — both undermine the policy and create legal risk.