Overview
The Acceptable Use Policy (AUP) is the policy most employees encounter directly. It defines how people may — and may not — use the organization's systems, networks, and data. Because it governs everyday behavior, it is one of the most practically important policies.
Learning objectives
- Define an acceptable use policy and its scope.
- Identify what an AUP typically covers.
- Understand its role in security and accountability.
Core concept
An AUP sets the rules for using organizational IT resources — computers, networks, email, internet access, and data. It typically covers:
- Permitted and prohibited activities (e.g. no installing unauthorized software, no accessing illegal content).
- Handling of company data and devices, including personal use limits.
- Password and account responsibilities.
- Consequences for violations.
- Often, a statement that activity may be monitored.
Users usually acknowledge the AUP when they join, making expectations explicit.
How it works
The AUP works by setting clear expectations and enabling accountability. Because users agree to it, the organization can enforce rules and take action against misuse, and users know where the lines are. It also reduces risky behavior (like installing unvetted software or reusing passwords) that creates vulnerabilities. Combined with monitoring, it supports investigations by establishing that certain activity was prohibited.
Practical example
An employee wants to install a free file-sharing tool to move large files. The AUP prohibits unauthorized software because such tools can introduce malware or leak data, and directs users to an approved alternative instead. The policy prevented a risky action and pointed to a safe path — and if the employee had ignored it, the AUP provides the basis for a response.
Cybersecurity relevance
The AUP is a frontline administrative control that shapes the daily behavior driving much of an organization's risk. It intersects with privacy (monitoring must be lawful and disclosed) and with legal/HR processes, making it a good example of how security, policy, and people meet.
Common mistakes
- Vague or unrealistic rules that users cannot reasonably follow.
- Never communicating or acknowledging the AUP, undermining enforceability.
- Monitoring without disclosing it, creating legal and trust problems.
Key takeaways
- The AUP defines permitted and prohibited use of organizational systems and data.
- It sets expectations, reduces risky behavior, and enables accountability and enforcement.
- It should be clear, acknowledged by users, and transparent about any monitoring.
Check your understanding
- Name three things a typical acceptable use policy covers.
- Why does having users acknowledge the AUP matter for enforcement?