Acceptable Use Policy

1. Purpose & Scope

This policy defines acceptable and unacceptable use of [Organization Name]'s information systems, devices, and accounts. It applies to all employees, contractors, and third parties granted access to company systems, whether on company-owned or personal (BYOD) devices.

2. Definitions

• Company Assets: Any system, device, account, network resource, or data owned, leased, or licensed by [Organization Name].
• Authorized User: An employee, contractor, or third party granted explicit permission to access a specific Company Asset.
• Confidential Information: Any information not intended for public disclosure, including but not limited to customer data, financial records, credentials, and internal business plans.

3. General Use & Ownership

Company Assets are provided for business purposes. [Organization Name] reserves the right to monitor, access, and audit activity on its systems and networks at any time, without further notice, consistent with applicable law. Employees should not expect privacy in communications or files created, stored, or transmitted on company systems.

4. Acceptable Use

Company Assets may be used for:

• Business purposes consistent with your role
• Limited, incidental personal use that does not interfere with work duties, consume significant resources, or violate any other section of this policy
• Software and tools that have been approved per your organization's software approval process

5. Prohibited Use

Employees may not use Company Assets to:

• Engage in illegal activity, harassment, or discrimination
• Access, alter, or disclose data beyond your authorized scope
• Attempt to bypass, disable, or circumvent any security control
• Install unauthorized software, browser extensions, or AI tools — see the AI Governance Policy, if adopted, for AI-specific rules
• Share login credentials or allow another person to use your account
• Connect personal storage devices or unapproved cloud services to company systems without authorization

6. Email, Internet & Social Media Use

Company email and internet access are provided for business use. Employees are responsible for exercising good judgment regarding what is reasonable personal use. Employees must not represent personal opinions as those of [Organization Name] on social media, and must follow this policy's confidentiality requirements in any public-facing communication.

7. Device & Account Security Responsibilities

• Lock your screen any time you step away from a device
• Follow the organization's Password/MFA Policy for all account credentials
• Report a lost or stolen device immediately — see the Incident Response Plan for the reporting process
• Keep company-managed devices on current security patches; do not disable endpoint security software

8. Monitoring & Privacy Notice

[Organization Name] may log, monitor, and review network traffic, email, and system activity for security, compliance, and operational purposes. This policy does not grant blanket authority to monitor personal accounts accessed on personal devices outside of company systems.

9. Reporting Violations / Security Concerns

Report a suspected policy violation or security concern to [Security Team / IT Help Desk / manager] as soon as you become aware of it. Good-faith reports made in the course of flagging a concern will not result in retaliation.

10. Enforcement

Violations of this policy may result in disciplinary action up to and including termination of employment or contract, and may be reported to law enforcement where the conduct is illegal.

11. Employee Acknowledgment

I have read, understood, and agree to comply with this Acceptable Use Policy.

12. Policy Review

This policy is reviewed at least annually and following any material change to the systems or risks it governs.