AssetCenter
Acceptable use policy template
Build an acceptable use policy for your employees: add your company’s details, choose the sections that fit, and download it as a Word document or copy the text. It covers devices, accounts, email, software, AI tools and data, with an acknowledgment for each person to sign.
In the print dialog, set the scale to 100% or Actual size. Choose Save as PDF as the printer to keep a copy.
What an acceptable use policy covers
An acceptable use policy (AUP) is the set of rules people agree to when they use an organization’s computers, phones, accounts, networks and data. It says what is allowed, what is not, what each person must do to keep devices and information safe, and what happens when the rules are broken. The preview above is a complete sample policy; every section can be edited once you download it.
- Who and what it covers. Employees, contractors and temporary staff, and every system and device they are given.
- Ownership and monitoring. That company devices and data belong to the company, and what may be monitored. Say this plainly; monitoring rules vary by country and state.
- Acceptable and prohibited use. Whether personal use is allowed, and the uses that are never acceptable.
- Security duties. Passwords, multi-factor authentication, screen locks, updates and approved software.
- Email, internet, AI tools and data. The everyday ways information leaks, including what may be pasted into an AI tool.
- Devices and their return. Looking after issued equipment, reporting loss quickly, and handing everything back on leaving.
- Enforcement and acknowledgment. The consequences of breaking the policy, and a signature or recorded acceptance.
Make it stick
A policy signed once and filed away rarely changes anything. Collect the acknowledgment when a device changes hands, at a new starter’s first day and at each replacement, and write the asset tags or serial numbers of what they received on it. Our IT onboarding checklist puts that step in order with the accounts and setup, and the offboarding checklist uses the same list to get everything back.
For a shorter policy about laptops and phones alone, our guide to a company device policy has device-only clauses and examples. The SANS acceptable use standard is a longer, more technical model for larger IT teams.
This template is a starting point, not legal advice. Employment, privacy and monitoring law differs between countries and states, so have HR and legal counsel review the policy before you adopt it.
Acceptable use policy FAQ
A document that sets the rules for using an organization’s technology: its devices, accounts, networks, software and data. Employees and contractors agree to it, usually by signing an acknowledgment, when they are given access.
Who it covers, who owns the devices and data and what may be monitored, acceptable and prohibited use, security duties such as passwords and multi-factor authentication, rules for email, internet, software, AI tools and data, looking after and returning devices, how to report problems, the consequences of breaking it, and an acknowledgment.
Not generally. Security frameworks, insurers and customer contracts may ask for documented security policies, and a signed policy is what makes the rules enforceable in practice. Monitoring and disciplinary clauses must follow local employment and privacy law, so have the policy reviewed.
Yes, if people use them for work. The AI section in this template limits work to approved tools, keeps confidential and personal information out of tools not approved for it, and makes each person responsible for checking what a tool produces.
Yes. It is an ordinary .docx with headings and bullet lists, and the gaps you still need to fill in are highlighted in yellow. It opens in Word, Google Docs, Pages and LibreOffice.
No. The policy is built in your browser, and the Word file is made there too. Your settings are remembered on this device only.
Match the policy to the devices people hold
AssetCenter records which person holds each laptop, phone and accessory, keeps every earlier assignment in the device’s history, and lets you attach the signed acknowledgment to the record. When someone leaves, their record lists everything to return. Free for up to 25 assets.