Acceptable Use Policy Template

An acceptable use policy tells staff what they may and may not do with company devices, accounts, data and services. It is one of the first policies auditors and customers ask about, and it is the natural place to set rules for generative AI tools.

Use plain language. Every rule here should be something a new starter can understand on their first day.

How to use this template

1. Replace the [bracketed] placeholders and delete rules that do not apply.
2. List your approved AI tools and messaging apps in section 7.
3. Check the monitoring wording in section 9 with HR or legal for your jurisdiction.
4. Collect a signed or recorded acknowledgement from every user.
5. Cover the key rules in onboarding and yearly awareness training.

The template

# Acceptable Use Policy

**Organisation:** [Organisation name]  |  **Version:** [1.0]  |  **Owner:** [Role]  |  **Next review:** [YYYY-MM-DD]

## 1. Purpose
To make clear how [Organisation name] devices, accounts, networks, data and services may be used, so that our information and our people stay safe.

## 2. Scope
All employees, contractors and third parties who use [Organisation name] devices, accounts or information, on any device and from any location.

## 3. General use
- Company systems are provided for business purposes. Limited personal use is allowed if it does not affect work, security or other people.
- You are responsible for activity on your accounts. Never share passwords or MFA codes.
- Do not try to bypass security controls, install unapproved software or access information you do not need for your role.

## 4. Accounts and passwords
- Use a unique, strong passphrase for every work account, stored in the approved password manager: [tool].
- MFA must be enabled wherever it is available.
- Report lost devices, suspected compromise or MFA prompts you did not start to [contact] immediately.

## 5. Email and communication
- Be cautious with links and attachments. Report suspicious messages with [report button / address].
- Verify any request to change payment details or send money through a known phone number before acting.
- Do not auto-forward work email to personal accounts.

## 6. Data handling
- Handle information according to its classification: [Public / Internal / Confidential / Restricted].
- Store work files only in approved locations: [systems].
- Share confidential or personal data externally only through [approved method] and only when there is a business need.

## 7. Generative AI tools
- Use only approved AI tools: [list].
- Do not enter confidential, restricted or personal data into AI tools unless the tool is approved for that data class.
- Review AI output for accuracy before using it, and do not present it as verified fact without checking.
- Do not use AI tools to make decisions about people without human review.

## 8. Devices and remote working
- Keep devices locked when unattended, updated and protected by the company's endpoint security.
- Personal devices may access [systems] only if they meet [requirements].
- Use a trusted network; avoid public Wi-Fi for sensitive work unless connected through [VPN / approved method].

## 9. Monitoring
[Organisation name] may monitor use of company systems to protect security and meet legal obligations, in line with applicable law and our privacy notice.

## 10. Breaches of this policy
Breaches may lead to removal of access and disciplinary action. Report concerns to [contact].

## Acknowledgement
I have read and understood this policy and agree to follow it.
Name: __________  Signature: __________  Date: __________

Frequently asked questions

Related

• ISO 27001 Annex A 5.10 Acceptable use
• How to run a security awareness training program
• Information security policy template
• Information Security Policy Template
• Vendor Security Questionnaire Template
• GDPR Data Breach Log Template