Acceptable use policy
Also known as AUP
The rules governing how staff may use company systems, devices, and data.
It defines what is permitted regarding personal use, software installation, data handling, and remote working, and it is what gives you standing to act when someone does something harmful.
To be enforceable it has to be communicated and acknowledged. An unread policy in a shared folder rarely supports a disciplinary process.
Where this comes up
Acceptable use policy sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
Security policy The written statement of what your organization requires regarding security, and who is responsible for what. Security awareness training Ongoing education that teaches staff to recognize and report attacks aimed at them. Insider threat Risk originating from someone who already has legitimate access: an employee, contractor, or partner.