An acceptable use policy sets the rules for how employees can use company devices, networks, accounts, and data. It typically covers personal use, prohibited activity, monitoring, what happens to company data on a personal phone, and increasingly which AI tools people are allowed to paste work into. No US law requires an AUP by name, though HIPAA's workstation use standard and PCI DSS requirement 12.2.1 both require its substance.

What goes in an acceptable use policy?

Most AUPs run through the same eight sections, and the order rarely varies:

  1. Scope. Who the policy binds and what it covers. Employees, contractors, and temps, on company hardware and on personal devices that touch company systems.
  2. Acceptable personal use. Almost every company allows some. The useful policies say how much and where the line sits, because "limited personal use" without an example gives nobody a decision rule.
  3. Prohibited activity. Harassment, illegal downloads, circumventing security controls, sharing credentials, installing unapproved software, running a side business off company infrastructure.
  4. Data handling. Which classifications of data can leave which systems, what gets encrypted, and what people can email to a personal address, which is usually nothing.
  5. Monitoring and privacy expectations. What the company logs and inspects, stated plainly.
  6. Personal devices and remote work. Enrollment requirements, what the company can wipe, and what happens on the last day of employment.
  7. AI and third-party tools. Which tools are approved and what employees can put into them.
  8. Consequences and reporting. What happens after a violation, and how someone reports a mistake without stalling for three days first.

The section people skip is the one about reporting. An AUP that only threatens discipline teaches employees to hide the laptop they left in a rideshare. Pair the consequences with a path that rewards speed.

Is an AUP legally required?

No US statute requires a document called an acceptable use policy. Several requirements demand its substance, and your regulated status decides which ones reach you.

The strongest hook is HIPAA. The Security Rule's workstation use standard at 45 CFR 164.310(b) says: "Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access electronic protected health information." That's an acceptable use policy under a different name.

It's also a standard rather than an implementation specification, which matters for how much discretion you get. Under 45 CFR 164.306(c), a covered entity or business associate must comply with the applicable standards. The "addressable" route at 45 CFR 164.306(d)(3), where you document that a specification isn't reasonable and appropriate and implement an equivalent alternative, applies to implementation specifications, and 164.310(b) isn't one.

One premise worth correcting, because it shows up on competitor pages: the GLBA Safeguards Rule and the FTC Safeguards Rule are the same instrument, 16 CFR Part 314, Standards for Safeguarding Customer Information. Citing them as two separate authorities inflates the legal case for an AUP and costs you credibility with anyone who checks. That rule requires access controls at 16 CFR 314.4(c)(1), including technical and, as appropriate, physical controls to authenticate and limit access to authorized users, and at 16 CFR 314.4(e)(1) it requires providing personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment.

For the content itself, NIST SP 800-53 Rev. 5 gives you a better spine than any vendor template. Its control PL-4, Rules of Behavior, is the control that covers what users may and may not do on a system. The enhancement PL-4(1), Social Media and External Site/Application Usage Restrictions, covers social media and external site use, posting organizational information publicly, and use of organization-provided identifiers and authenticators on external sites, which are three of the five things employees actually get wrong. Pair it with AC-8, System Use Notification, for the login banner.

How should an AUP handle monitoring and personal devices?

Monitoring is where an AUP either earns trust or burns it. Write what the company actually inspects, at the level of specificity an employee can act on: email and chat on company accounts, web traffic on the corporate network, endpoint telemetry on managed devices, file access logs. Then say what the company doesn't touch. A policy that claims unlimited inspection rights and never exercises them still teaches people that the security team reads everything, which drives work onto personal accounts you can't see at all.

Personal devices need three answers most policies leave out. What has to be true before a personal phone gets mail access. What the company can remotely wipe, and whether that means the whole device or a managed container. And what happens at offboarding, on the day rather than eventually. Employees consent to the first two when they enroll, so the policy is where they read about it, not the day it happens.

Company data on a personal device is also where an AUP meets your privacy program. If the device holds personally identifiable information, the handling rules in the AUP have to match the ones in your privacy notices and your vendor contracts, or you've written two policies that contradict each other.

How should an acceptable use policy handle AI tools?

This is the fastest-moving section in the document and the one most likely to be out of date. Four decisions carry most of the weight:

  • Which tools are approved, by name, kept in a list outside the policy so updating it doesn't require a policy revision cycle.
  • What can go in. Public information, internal but non-sensitive work, customer data, regulated data, and code each need their own answer. Most companies land on: nothing customer-identifying, nothing regulated, nothing under NDA.
  • What people have to disclose. Whether AI-assisted work gets labeled, and in which contexts.
  • Where a human has to decide. Hiring, discipline, credit, and access decisions are the obvious ones, and they carry legal exposure that general AI policy language doesn't address. The algorithmic bias entry covers why.

A separate AI acceptable use policy is often cleaner than a subsection, because it moves at a different speed and reaches a different audience.

How do you get people to actually read it?

You don't, by writing it well. You get there by shortening it, teaching it, and asking for something back. Cut the AUP to the length someone reads in five minutes and move the detail into standards documents that only the security team maintains. Teach the two or three decisions employees make weekly rather than the full policy. Then collect a policy attestation, because an attestation is how you prove the policy reached the people it binds, which is the first thing a regulator or a plaintiff asks for.

Review the whole thing on a schedule tied to change rather than the calendar: a new device class, a new AI tool, a new regulated data type, or an incident that the policy failed to prevent. The phishing simulation results are a decent trigger too, since repeated failures in one team usually point at a policy gap rather than a training gap.

FAQ

Is an acceptable use policy the same as a code of conduct?

No. A code of conduct sets behavioral expectations across the whole company, including conflicts, gifts, and harassment. An AUP covers one domain: how people use company technology and data. Most companies run both, with the code referencing the AUP rather than absorbing it.

How often should employees re-attest to the AUP?

Annually is the convention, and there's no general legal cadence. Re-attest on change too. A material revision that nobody signed is a revision you can't enforce.

Does an AUP apply to contractors?

It should, and the mechanism is different. Employees agree through onboarding and attestation. Contractors agree through their contract, so the AUP needs to be an attached exhibit or an incorporated reference rather than something you email them later.