An acceptable use policy example works best as a section-by-section blueprint, because the document only does its job when it covers scope, prohibited conduct, user duties, monitoring consent, industry rules, and enforcement in one place. The sections below lay out what each part should say, with the legal reasoning behind the language, so you can adapt a working AUP for your organization rather than start from a blank page.
Scope: Who and What the Policy Covers
The opening section defines who is bound by the policy and what resources it protects. List every category of user who might connect to the network or handle organization data: full-time employees, part-time staff, contractors, interns, temporary workers, guests on the Wi-Fi, and third-party vendors with remote access. If someone can log in, they belong in the scope clause.
Then list the resources. Physical hardware like servers, laptops, and mobile devices; software licenses; cloud platforms; email accounts; network bandwidth; and stored data. State explicitly that the rules apply to any device connecting to the organization’s network, regardless of who owns it. That single sentence is what gives the policy teeth when a contractor’s infected personal laptop causes a breach.
Contractor and Guest Accounts
Temporary users deserve their own paragraph. Contractor and guest accounts should carry built-in expiration dates that match the length of the engagement, with automatic credential expiration and immediate deactivation when work ends. Limit temporary users to the specific systems they need rather than granting broad network access. Accounts that outlive the relationship are a common attack vector.
Prohibited Activities
This is the section most users will actually read, so it needs to be concrete. Vague language like “misuse of systems” gives users no guidance and gives the organization nothing to enforce. Break prohibited conduct into categories.
Unauthorized Access and System Interference
Federal law already criminalizes accessing a protected computer without permission or exceeding the access you were given. The Computer Fraud and Abuse Act makes it a crime to knowingly access a computer without authorization and obtain information, or to transmit code that intentionally damages a system.1Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers Your AUP should mirror those boundaries in plain terms: no accessing files, folders, or systems you haven’t been authorized to use, and no running tools that probe, disrupt, or degrade the network.
The Supreme Court narrowed “exceeds authorized access” in 2021, holding that it covers accessing off-limits areas of a computer, not using legitimately accessible information for an improper purpose.2Supreme Court of the United States. Van Buren v. United States If you want to prohibit employees from using authorized access for personal gain or side projects, spell that out as a separate policy violation. Don’t rely on federal computer fraud law to do the work.
Intellectual Property and Personal Use
Prohibit downloading or distributing copyrighted material through company systems, and storing or transmitting trade secrets belonging to other organizations. Restrict using company resources for outside business ventures or personal commercial activity. An employee running an eBay store from a company laptop consumes bandwidth, creates liability, and stores non-business data on systems the organization may need to audit.
Harassment and Offensive Content
Prohibit using organization systems to send threatening, discriminatory, or sexually explicit content. Make the language broad enough to cover email, internal messaging platforms, and any content viewed or stored on company equipment. Cross-reference the organization’s broader harassment and discrimination policies rather than duplicating them.
Social Media and Protected Employee Speech
This is where drafters routinely overcorrect. Federal labor law protects employees who discuss wages, benefits, and working conditions with coworkers, even on public platforms. Section 7 of the National Labor Relations Act guarantees the right to engage in concerted activities for mutual aid or protection.3Office of the Law Revision Counsel. 29 U.S. Code 157 – Right of Employees as to Organization, Collective Bargaining, Etc.
A social media policy cannot prohibit employees from complaining about pay or working conditions online, organizing with coworkers about workplace issues, or sharing salary information. The National Labor Relations Board has made clear that employees have the right to join together on social media to address work-related concerns, and that policies restricting this activity violate federal law. The line sits at statements that are egregiously offensive, knowingly false, or that publicly disparage an organization’s products without any connection to a labor dispute.4National Labor Relations Board. Social Media An individual griping about a bad day without connecting it to group concerns is not protected either. Acknowledge these protections explicitly in the policy rather than risk having an overbroad ban struck down.
Generative AI Rules
Pre-2023 AUPs usually miss this entirely, and it has become one of the highest-risk gaps. Employees who paste proprietary code, customer data, or internal strategy documents into a public AI chatbot may be exposing that information to the model’s training pipeline with no way to retrieve it.
Categorize which AI tools are approved for work use and which are prohibited. Many organizations allow specific enterprise-tier platforms that offer data isolation while banning consumer-grade tools where inputs may be stored or used for model training. Prohibit entering confidential information, trade secrets, customer data, or internal credentials into any unapproved AI system.
Copyright ownership is the other landmine. The U.S. Copyright Office has stated that material generated entirely by AI, without human creative control, is not eligible for copyright protection. When a human selects, arranges, or substantially modifies AI-generated content, the human-authored portions can be protected, but the AI-generated elements must be disclaimed in any registration application.5Federal Register. Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence Require employees to disclose when deliverables include AI-generated content and set clear internal ownership rules for that work product.
Shadow IT and Unauthorized Software
Employees installing unapproved applications on company devices is one of the fastest ways to blow a hole in network security. Unauthorized software may bypass encryption, skip logging, or introduce malware onto a system that connects to everything else. Prohibit installing or running any software, browser extension, cloud service, or plug-in that hasn’t been approved by IT.
The risks are not theoretical. Unapproved tools can create compliance violations under HIPAA, PCI-DSS, or other frameworks that require organizations to control how data is stored and transmitted. There is also a licensing angle: if an employee installs pirated or improperly licensed software on a company machine, the organization can face liability from the software vendor. State plainly that only IT-approved software may be installed and that violations carry the same consequences as other prohibited activity.
User Security Responsibilities
The policy also has to state what users must actively do.
Passwords and Multi-Factor Authentication
Password requirements should reflect current federal guidance rather than outdated complexity folklore. NIST Special Publication 800-63B sets the floor at a minimum of eight characters for user-chosen passwords and explicitly recommends against imposing composition rules like mandatory special characters or forced periodic changes.6National Institute of Standards and Technology. NIST Special Publication 800-63B – Digital Identity Guidelines: Authentication and Lifecycle Management Many organizations set a minimum of twelve characters, which exceeds the NIST floor and is a reasonable choice. Requiring a grab bag of uppercase letters, symbols, and numbers is no longer considered best practice.
Multi-factor authentication should be mandatory for any system containing sensitive data. State that users are required to enable it wherever offered and that sharing authentication credentials or one-time codes is prohibited.
Device Security and Incident Reporting
Require users to lock screens when stepping away, keep operating systems and software updated, and report lost or stolen devices immediately. A stolen laptop with cached credentials can give an attacker hours of access if nobody knows it’s gone. Include a specific reporting channel and a clear expectation of how quickly the report must happen.
BYOD and Remote Work
If employees connect personal devices to company systems, the AUP needs a dedicated section. At minimum, state what the organization can do to a personal device that accesses its data.
Remote wipe is the most contentious point. Organizations that manage company data on personal phones or laptops often reserve the right to erase that data remotely if the device is lost, stolen, or the employee leaves. A full device wipe destroys personal photos, messages, and apps alongside company data. Containerization or mobile application management isolates company data in a separate partition that can be wiped without touching personal files. Specify which approach the organization uses and require employees to consent in writing before enrolling a personal device.
Require that personal devices connecting to the network meet minimum security standards: current operating system, active screen lock, no jailbreaking or rooting. If the organization requires management software on personal devices, disclose that requirement upfront. An employee who discovers after the fact that their employer installed monitoring software on their personal phone has grounds for an uncomfortable conversation with HR and, depending on the jurisdiction, potentially with a lawyer.
Industry-Specific Compliance
A generic AUP works for many organizations, but certain industries face regulatory mandates the policy must address directly.
Healthcare: HIPAA
Organizations covered by the Health Insurance Portability and Accountability Act must implement technical safeguards including access controls that limit who can view electronic protected health information, audit mechanisms that track who accessed what and when, and transmission security that guards against interception during data transfer.7eCFR. 45 CFR 164.312 – Technical Safeguards Translate those requirements into user-facing rules: no emailing patient data through personal accounts, no storing health records on unapproved devices, and no accessing patient files outside of a direct treatment or operational need.8U.S. Department of Health and Human Services. Summary of the HIPAA Security Rule
Financial Services: GLBA Safeguards Rule
Financial institutions subject to the Gramm-Leach-Bliley Act must maintain safeguards for customer financial data, including encryption, multi-factor authentication, and continuous monitoring for unauthorized access. The amended Safeguards Rule requires institutions to notify the FTC no later than 30 days after discovering a breach involving at least 500 consumers.9Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect Assign every user a role: reporting suspicious access immediately, never sharing credentials for systems containing customer financial data, and following data classification protocols that distinguish public information from restricted records.
Education: FERPA
Schools and universities that receive federal funding must protect student education records under the Family Educational Rights and Privacy Act. FERPA generally bars releasing personally identifiable student information without written parental consent, with limited exceptions for school officials who have a legitimate educational interest.10Office of the Law Revision Counsel. 20 U.S. Code 1232g – Family Educational and Privacy Rights Specify that staff may not share student records with unauthorized third parties, may not store student data on personal cloud accounts, and must follow institutional procedures for responding to records requests from parents or eligible students.
Monitoring and Privacy Consent
Most AUPs state that users have no expectation of privacy on organization-owned systems. That language is the legal foundation for the organization’s ability to review emails, inspect files, and log network activity.
Federal wiretapping law generally prohibits intercepting electronic communications, but the Electronic Communications Privacy Act carves out key exceptions for employers. A provider of electronic communication services may intercept communications in the normal course of business when necessary for the service or to protect the provider’s rights and property. Interception is also lawful when one party to the communication has given prior consent.11Office of the Law Revision Counsel. 18 U.S. Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited That second exception is why the signed acknowledgment matters: when an employee signs a policy acknowledging that the organization monitors communications on its systems, the employee has provided consent.
State plainly that the organization may monitor, access, review, and store any data transmitted through or stored on its systems, and that monitoring may occur without advance notice on a case-by-case basis. Some states impose additional notice requirements beyond federal law, so organizations operating in multiple jurisdictions should have legal counsel review the monitoring language for local compliance.
Enforcement and Consequences
A policy with no teeth is a suggestion. The enforcement section needs a graduated range of consequences tied to the severity of the violation.
- Minor violations: verbal or written warning with mandatory retraining. Examples include forgetting to lock a workstation or minor personal use of company email.
- Moderate violations: temporary suspension of system access, formal written reprimand, or reassignment of duties. Examples include installing unauthorized software or ignoring repeated password requirements.
- Severe violations: termination of employment or contract. Examples include intentionally accessing restricted files, distributing malware, or leaking confidential data.
- Criminal conduct: referral to law enforcement and full cooperation with any resulting investigation. This covers activity like data theft, fraud, or unauthorized access that violates the Computer Fraud and Abuse Act.1Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers
Reserve the organization’s right to suspend access immediately, before a full investigation is complete, when there is reason to believe ongoing access poses a security risk. Waiting until the investigation wraps up to revoke credentials is how breaches get worse.
Acknowledgment, Distribution, and Updates
The best-written AUP is worthless if you cannot prove someone agreed to it. Every covered individual should sign an acknowledgment, either a physical signature or an electronic one captured through a click-through agreement at login. The acknowledgment should state that the user has read the policy, understands its terms, and agrees to comply. Store these records in personnel files or a secure digital system where they can be retrieved if a dispute arises.
For new employees, include the AUP in onboarding materials and require signature before granting any system access. For existing employees, redistribute the policy whenever it is materially updated and collect a fresh acknowledgment each time. A policy signed in 2022 that has since added AI guidelines and BYOD rules does not prove the user agreed to those new provisions.
Review the entire policy at least once a year, and sooner whenever the organization adopts a significant new technology, experiences a security incident, or faces changes in the regulatory landscape. Involve IT, legal counsel, and HR in the annual review so the document stays aligned with both the technical environment and current law. Version-date every revision so there is never ambiguity about which version a user agreed to.