Acceptable Use Policy for Business: What to Include

Acceptable Use Policy for Business: What to Include

An acceptable use policy (AUP) is a short document that tells employees what they may and may not do with your company's technology and data, and what happens when they break the rules. For a small business, the best version is plain, specific and signed by every person who touches your systems. This guide covers what to put in it, sample rules you can adapt, how to handle monitoring and privacy in the U.S., and how to roll it out so it gets followed.

Key Takeaways

• An AUP sets rules for company devices, networks, email, internet access, software and data, and states the consequences of violations.
• Keep it short and readable. A policy nobody reads cannot protect you, and a signed acknowledgment is what makes it enforceable.
• State plainly that the company may monitor its own systems and that employees should not expect privacy on them.
• Ownership should be shared across management, HR, legal counsel (if you have one) and whoever runs your IT, and the policy should be reviewed on a schedule.
• The AUP works best alongside technical controls such as multi-factor authentication (MFA), backups and device management.

Table of Contents

• What an Acceptable Use Policy Is
• Why a Small Business Needs One
• What to Include in an Employee Acceptable Use Policy
• Employee Acceptable Use Policy Examples: Acceptable vs. Prohibited
• Monitoring and Privacy: What U.S. Employers Should Address
• How Long Should It Be, and How Should It Read?
• How to Roll Out the Policy Step by Step
• Enforcement and Consequences
• Where an AUP Fits with Your Technical Controls
• Get Help Turning Your Policy into Practice
• FAQ
• Sources

What an Acceptable Use Policy Is

An AUP stipulates the constraints and practices a user must agree to in order to use a corporate network, the internet or other computing resources. Many organizations require employees to sign it before they receive a network login. CompTIA describes it as a formal document with rules for employees and other stakeholders using company IT resources: computers, laptops, mobile devices, networks, software, email accounts and internet access.

In practice, it answers questions your staff would otherwise guess at:

• Can I check personal email on my work computer?
• Can I save client files to my personal Dropbox?
• Can I plug in a USB drive I found?
• Can I install the software I used at my last job?
• Who do I tell if my laptop is stolen?

The AUP is one policy in a set. It ties into your password, system access and device rules, and it defines acceptable use of company assets and communications.

Why a Small Business Needs One

Small teams often assume a policy is for large companies. The reverse is closer to the truth: with a handful of employees, one careless click or one file copied to a personal account can reach everything you own.

An AUP helps in four concrete ways:

1. It sets expectations. It lays out acceptable and unacceptable behavior, gives you a mechanism to compel compliance and stipulates penalties for noncompliance. That also helps you avoid conflicts and litigation.
2. It reduces accidental incidents. Without clear rules, the risk goes up of accidental data breaches, such as copying sensitive data to personal cloud storage, and of disruption, such as ransomware arriving through inappropriate web browsing, according to Verizon's guidance.
3. It documents due diligence. A written, acknowledged policy supports your ability to show you took reasonable steps, which matters for reputation and for conversations with clients, insurers and auditors.
4. It supports a recognized framework. The NIST Cybersecurity Framework 2.0 small business guide asks whether acceptable use policies exist for business-owned and employee-owned devices that access business resources, and whether employees have been educated on them.

If you handle patient records, client files or tax data, the AUP is also the place where your compliance obligations (HIPAA, IRS data security expectations, CMMC for defense supply chains) turn into daily rules staff can follow.

What to Include in an Employee Acceptable Use Policy

IANS says a policy should spell out the rules people follow with the organization's technology and data, and what happens when they break them. That usually covers company devices and collaboration tools, how data is handled at each sensitivity level, approved applications, internet, email and social media use, whether personal use is allowed, bans on unapproved shadow IT and AI tools, monitoring, and consequences.

Here is how that translates into sections for a small business:

Get Safe Online adds useful prompts: whether private internet use is acceptable and when, what content is off-limits, how confidential information is treated, rules for installing software (including piracy), guidance on strong passwords, and what happens if the policy is breached.

Company-owned and personal devices

AUPs can apply both to devices the organization supplies and to personal devices that employees use for work. If your staff check email on their own phones, say so in the policy, and spell out the minimum requirements: a screen lock, a current operating system, and a promise to report a lost phone the same day.

Removable media and USB drives

USB drives are one of the most common ways data walks out the door or malware walks in. If your business handles regulated data, give removable media its own rule or its own policy. Our guide to an auditable USB device control policy shows how to do that for HIPAA and CMMC environments.

Remote and hybrid work

If anyone works from home, the AUP should reference how they connect, where they save files and what they do on shared networks. Our remote work security checklist lines up those habits with CISA guidance and works well as a companion to the policy.

Employee Acceptable Use Policy Examples: Acceptable vs. Prohibited

Examples make a policy concrete. These are drafting ideas to adapt to your own business, not legal language to paste in unchanged.

Typically acceptable

• Using company email and file storage for work, with MFA turned on.
• Brief personal browsing on a break, if the policy allows it and it does not add cost or risk.
• Using approved cloud apps and approved AI tools for tasks that do not involve confidential data.
• Reporting a suspicious email, even after clicking it, immediately.

Typically prohibited

• Sharing passwords, or using another person's account.
• Installing unapproved software or connecting unapproved devices.
• Sending confidential information outside the company without encryption. The University of Massachusetts hospital system's acceptable use policy lists this, along with using company resources with malicious intent or for personal gain.
• Sharing company information, publicly or privately, without authorization. The State of Kansas IT security standards treat organizational information assets as strictly for the organization's use and say inappropriate use may bring disciplinary action up to termination.
• Copying client, patient or financial data to personal cloud storage or personal email.

Government and hospital policies are far longer than a small business needs. Borrow their clear categories, not their length.

Monitoring and Privacy: What U.S. Employers Should Address

This is the part of an AUP where wording matters most. According to a Littler employment law white paper, U.S. employers are generally presumed to have the right to inspect information stored on, and monitor communications transmitted by, their own corporate resources. The AUP should state the employer's intention to exercise those rights and that employees should not expect privacy. Real-time monitoring that intercepts communications may require prior informed consent.

IANS recommends the policy explain what is monitored and why, and that users should not expect privacy on corporate devices and accounts. It also notes that some jurisdictions, such as New York, Connecticut and Delaware, require written notice and acknowledgment before an employer monitors email or internet use. If you employ people in more than one state, check each state's rules.

Two practical points follow:

• Be specific. Say which systems are monitored (email, web filtering, endpoint security, remote access logs) rather than leaving it vague.
• Get the acknowledgment in writing. A signature on a policy that names monitoring is stronger than a policy buried in a shared folder.

Because employment and privacy law varies by state and by industry, have your attorney review the final version, especially the monitoring and discipline sections. Law firms, medical and dental practices and other regulated businesses should also confirm that the policy matches their professional and regulatory duties.

How Long Should It Be, and How Should It Read?

Aim for a few pages at most. For a business under about 100 people, a one-to-three page document that people will actually read is a realistic target. Use these habits:

• Write in plain sentences: "Do not share your password" beats "Credential sharing is prohibited."
• Put the rules people break most often near the top.
• Use headings and short lists so staff can find a rule in seconds.
• Define a few terms once (confidential data, personal device, shadow IT) and use them consistently.
• Name a person or a help desk for questions and incident reports.

If you want depth, link to separate procedures (backup, remote access, USB control) rather than stuffing them into the AUP.

How to Roll Out the Policy Step by Step

A good rollout turns the document into a habit.

1. Assign owners. Verizon's guidance says developing, delivering and enforcing the AUP is shared among HR, legal, IT security and IT support, so it is not an IT-only document. In a small business, that may be an owner, an office manager and your IT provider.
2. Align it with employment documents. Get Safe Online recommends aligning policies with employee contracts and disciplinary procedures, and making them readily available once finalized.
3. Collect signatures. Signing an AUP might be part of an employment contract and often happens during onboarding. Do the same for current staff when you launch it.
4. Train. Walk through the five or six rules that matter most, with real examples such as a phishing email or an unsafe file-sharing link. NIST's small business guidance specifically asks whether employees have been educated on these policies.
5. Make it findable. Keep the current version in a shared location that everyone can reach, and link it from your new-hire checklist.
6. Review on a schedule. Assign someone to monitor it, and review it regularly. New tools, such as generative AI apps, change what needs covering.

If your onboarding is manual and acknowledgments get lost, onboarding automation for HR teams can help make sure every new hire signs before getting access.

Enforcement and Consequences

A policy without enforcement is a suggestion. Cowbell's cybersecurity guide advises that after creating an AUP it is crucial to emphasize its importance and establish procedures to enforce it.

A workable enforcement approach for a small team:

• Define tiers. A first accidental misstep, such as clicking a phishing link and reporting it, gets coaching. Sharing credentials or moving client data to a personal account gets formal discipline and an incident review.
• Apply it consistently. Uneven enforcement undermines the policy and creates HR risk.
• Use technical guardrails. Where possible, require acknowledgment before access, enforce MFA and block risky behavior with settings rather than relying on memory.
• Handle departures cleanly. When someone leaves, revoke access the same day and recover every device. A documented laptop offboarding process with certified data destruction supports the policy's rules about company data and equipment.

The Kansas standard mentioned above shows one hard-edged approach: a legal notice banner that users acknowledge before the logon prompt, with a warning that inappropriate use may lead to monitoring and discipline. A small business can copy the idea with a short login message on shared or sensitive systems.

Where an AUP Fits with Your Technical Controls

Rules on paper do not stop ransomware by themselves. They work best when technology backs them up:

• MFA and strong passwords make the "never share your password" rule safer to follow.
• Email filtering and phishing training support the rule on suspicious messages.
• Backups you have tested limit the damage when someone slips anyway.
• Device management and a properly configured firewall keep unapproved devices and risky traffic out. Our firewall best practice checklist walks through the settings.
• Role-based access keeps people to the files they need. For one example, see how to manage user access in a law firm network.

As a managed IT provider, we write these controls into daily operations for small businesses in Norman, Moore and Oklahoma City, so the AUP describes what actually happens on your network.

Get Help Turning Your Policy into Practice

Writing the policy is the easy part. Making sure your devices, accounts and backups match it is where most small businesses need support.

Great Plains Networking provides managed IT support with 24/7 monitoring, same-day response and no long-term contracts, plus cybersecurity services covering ransomware and phishing protection. We explain everything in plain language, and we work with law firms, dental and medical practices, accounting firms, manufacturers and nonprofits.

Not sure where you stand? Take the 10-minute readiness audit to see which gaps to close first, or ask for a free network assessment on our home page.

FAQ

Is an acceptable use policy legally required for a business?

No general U.S. law says every business must have one, but it supports compliance and risk management. NIST's small business guidance asks whether such policies exist and whether employees have been educated on them. Regulated businesses, such as medical practices and defense suppliers, may have specific requirements, so confirm them with your compliance advisor or attorney.

Do employees have to sign an acceptable use policy?

They should. Signing is often part of onboarding and may be written into the employment contract. A signed acknowledgment shows the employee saw the rules, including those on monitoring, and it gives you a record if you ever need to enforce them.

How often should we update our AUP?

Review it on a regular schedule, and whenever you adopt significant new technology, such as a new AI tool, a new remote work arrangement or a new regulated line of business. Name one person responsible for the review and circulate each new version.

What is the difference between an AUP and a security policy?

An AUP focuses on what users may and may not do. Broader security policies cover how the organization protects systems, such as password standards, system access and device configuration. The two connect, and the AUP is usually the part every employee signs.

Can we monitor employees' email and internet use?

In the U.S., employers are generally presumed to be able to monitor their own corporate resources, but you should say so in the policy and get written acknowledgment. Some states require written notice before monitoring email or internet use, so have your attorney confirm the rules where your employees work.

Sources

• What is acceptable use policy (AUP)? | TechTarget
• Security Awareness Training: Why You Need a Corporate Acceptable Use Policy | CompTIA
• Acceptable Use Policies for Workplace Technology | Verizon
• NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide
• What Is an Acceptable Use Policy? Contents and Enforcement | IANS
• Staff Policies | Get Safe Online
• Acceptable Use of Electronic Resources | UMass Memorial Health Care
• Information Technology Security Standards and Cybersecurity Guide | State of Kansas
• Ten Tips for Preparing an Effective Acceptable Use Policy | Littler
• Cowbell Cybersecurity Resource Guide

Recommended

• Application Whitelisting (Allowlisting) for Small Business
• Auditable USB Device Control Policy for SMBs, HIPAA and CMMC Ready
• Small Business Data Retention Policy That Is Ransomware Proof and IRS Compliant
• Audit Ready Patch Management Policy Template for SMBs in 30 Days