To fill out an Acceptable Use Policy form, enter your organization’s full registered legal name at the top, list the systems and user groups the policy covers, complete each required clause (permitted use, prohibited activities, monitoring consent, security standards, intellectual property ownership, incident reporting, and consequences), and finish with dated signature lines. The form only works if the entity name matches your registered business, the clauses track federal law, and the signed copy is stored where you can retrieve it.
Scope the Users and Systems First
Before you touch the clauses, write down what the policy covers. On the asset side, that means network hardware (servers, routers, wireless access points), endpoint devices (laptops, phones, tablets), software licenses, cloud platforms, and VPN gateways. On the people side, list each category separately: full-time employees, part-time staff, independent contractors, interns, and temporary visitors. Their access levels differ, and a form that doesn’t name them leaves gaps you’ll feel later when you try to enforce it.
Use the organization’s full legal name, not a trade name or abbreviation. A mismatch between the signing entity and the registered employer creates enforceability problems that are easy to avoid at the drafting stage.
Clauses to Complete
At a minimum, the form needs these fields filled in:
- Permitted use: a short statement of the policy’s purpose and the work-related activity the systems are meant for.
- Prohibited activities: specific actions that are off-limits, such as downloading copyrighted material without authorization, accessing illicit content, installing unapproved software, or using company systems to harass or discriminate against coworkers. Name restricted sites and software categories where you can; “non-business social media platforms” works as a catch-all, but naming specific applications removes ambiguity.
- Monitoring disclosure: a plain statement that the organization may monitor activity on its devices and networks.
- Security requirements: password standards, multi-factor authentication expectations, and rules for handling sensitive data.
- Intellectual property ownership: a clause stating that work product created on company time and equipment belongs to the employer.
- Incident reporting: the name or role of the IT contact who receives reports of security incidents and policy violations.
- Consequences for violations: a graduated range from written warning to termination or legal action, so enforcement is proportional and documented.
- Signature and date lines: the acknowledgment is what makes the whole document enforceable.
Writing the Monitoring Clause
The monitoring section carries real legal weight, so plain language matters. State what the organization monitors (email content, internet browsing history, file downloads, chat messages), say that users should have no expectation of privacy on company-owned devices, and identify who has access to the monitoring data. “The company may observe activity” is too vague to rely on.
The signature is what gives the monitoring teeth. Under 18 U.S.C. ยง 2511(2)(d), a non-government party can intercept electronic communications when one party has given prior consent.1Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited The signed AUP is that consent. Without it, monitoring email, browsing, or file transfers on company systems can expose the employer to federal wiretapping claims.
State Notices That Stack on Top
Several states require more than the signed form. Connecticut requires employers to post a conspicuous notice about any monitoring tools in use. Delaware requires daily notification through a browser homepage message, email header, or similar alert, unless the employee has signed a monitoring agreement. New York requires both a posted workplace notice and a written copy of the monitoring policy that each employee must sign; fines start at $500 for a first violation and climb to $3,000 per offense for repeat noncompliance. If you operate across state lines, check each location.
Harassment and Anti-Discrimination Language
Federal anti-discrimination law shapes what the prohibited-activities section must include. Harassment based on race, color, religion, sex, national origin, age, disability, or genetic information violates Title VII of the Civil Rights Act of 1964, the Age Discrimination in Employment Act, and the Americans with Disabilities Act.2U.S. Equal Employment Opportunity Commission. Harassment Conduct becomes unlawful when it is severe or pervasive enough that a reasonable person would find the work environment hostile or abusive. State plainly on the form that company email, messaging platforms, and shared drives are not exempt: a discriminatory joke, slur, or offensive image sent through company systems carries the same legal weight as saying it out loud in the office.
Intellectual Property Ownership
Fill in a clause putting employees on notice that code, designs, reports, presentations, and other materials produced using company resources belong to the organization. Under federal copyright law, the employer is considered the author of any work made for hire and owns all rights in it, unless both parties have agreed otherwise in a signed written instrument.3Office of the Law Revision Counsel. 17 USC 201 – Ownership of Copyright A work made for hire covers what an employee prepares within the scope of employment, plus certain specially commissioned work where both parties sign a written agreement.4U.S. Copyright Office. Circular 30 – Works Made for Hire
Independent contractors are not employees, and the work-for-hire doctrine is narrower for them. If contractors sign your AUP, that alone may not transfer IP rights. A separate written agreement explicitly assigning intellectual property is the safer route.
What You Cannot Put in the Form
Two areas of federal law limit how broadly you can draft the prohibitions. Overreach can get the clause thrown out, so trim before you sign anyone.
The National Labor Relations Act protects employees’ right to discuss wages, benefits, and working conditions with each other, including on company email or messaging platforms.5National Labor Relations Board. Concerted Activity A clause that bans “discussing internal company matters on company systems” or “posting negative comments about the organization” risks being struck down as an unfair labor practice. The protection applies in union and non-union workplaces alike, and has limits only for statements that are knowingly false or egregiously offensive.
The form also cannot be used to punish whistleblowers. OSHA enforces more than 20 federal whistleblower statutes that prohibit retaliation for raising concerns about workplace safety, environmental violations, financial misconduct, and similar issues.6Occupational Safety and Health Administration. OSHA Whistleblower Protection Program If an employee uses a company computer to file an OSHA complaint or email a regulator about unsafe conditions, treating that as an AUP violation is itself a federal violation.
Password and MFA Specifics
Align the security section with current federal guidance rather than older corporate habits. NIST Special Publication 800-63B sets the baseline most compliance frameworks reference: user-chosen passwords must be at least eight characters, and systems should not force arbitrary rotation (every 60 or 90 days, for example). Rotation should kick in only when there is evidence of a breach.7National Institute of Standards and Technology. NIST Special Publication 800-63B – Digital Identity Guidelines Many security professionals now recommend 12 or 16 characters as the minimum, because longer passphrases resist brute force and are easier to remember.
Multi-factor authentication adds a second layer, typically a one-time code from a phone app, a hardware token, or a biometric scan, so a stolen password alone cannot unlock an account.8Cybersecurity and Infrastructure Security Agency. Multifactor Authentication If your AUP requires MFA, list which systems it applies to (remote access, VPN, sensitive databases) and which authentication methods are approved. Compliance improves when the policy explains what to do rather than just saying MFA is mandatory.
Add a BYOD Section If Personal Devices Are in Use
If employees use personal phones, tablets, or laptops for work, add a bring-your-own-device section or a separate BYOD addendum they sign on its own. The central question is what happens to company data living on a device the employee owns. Cover:
- What counts as a personal device: smartphones, personal laptops, tablets, and home desktops used to access company email, cloud drives, or internal applications.
- Security requirements: whether the device must run mobile device management (MDM) software, keep its operating system current, and use a screen lock or biometric authentication.
- Remote wipe consent: in the United States, remotely wiping a personal device without written permission creates legal risk. Include an explicit clause granting the organization permission to perform a selective or full wipe, and have the employee sign it.
- Separation of data: whether the MDM can isolate and delete only work data, or whether a full wipe is the fallback. Employees sign more readily when a selective wipe leaves personal photos and messages alone.
- Termination process: how company accounts, email profiles, and data get removed from the personal device when the employee leaves.
Signing the Form
Both ink and electronic signatures work. The federal E-SIGN Act provides that a signature or contract cannot be denied legal effect solely because it is in electronic form.9Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity E-signature platforms generate an audit trail with timestamps for when the document was sent, viewed, and signed, which helps if you ever need to prove the employee received the policy.
Keep the AUP as a standalone document with its own signature line rather than burying it inside a broader handbook. That removes any later argument that the employee did not see the technology policy. Send an automated confirmation receipt so the signer has a personal copy.
Storing the Signed Form
Put the signed form in the employee’s personnel file. Digital copies belong in encrypted folders accessible only to authorized HR and legal staff. EEOC regulations require employers to keep personnel and employment records for at least one year from the date the record was made or the personnel action occurred, whichever is later; for involuntarily terminated employees, the one-year clock runs from the termination date.10U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602 The Department of Labor separately requires payroll records, collective bargaining agreements, and related employment documents to be kept for at least three years.11U.S. Department of Labor. Fact Sheet 21 – Recordkeeping Requirements Under the Fair Labor Standards Act Many organizations hold signed AUPs longer, typically the duration of employment plus three to five years, because violations can surface well after the fact.
Re-Sign When Things Change
Review the form annually and redistribute it for re-signing whenever something material changes. Triggers include adopting a new cloud platform, launching a BYOD program, expanding remote work, changing monitoring tools, or finding that a clause conflicts with a new legal development. Put a revision date in the header and a short change summary so both sides know which version governs.