Acceptable Use PolicyTemplate and Guide

What Is an Acceptable Use Policy?

An acceptable use policy (AUP) is a written set of rules that tells employees, contractors, and other workforce members what they may and may not do with an organization's computers, networks, accounts, email, internet access, software, cloud services, and data. It defines authorized use, prohibits specific behaviors, puts users on notice that their activity on company systems is monitored, assigns a duty to report security problems, and states the consequences of a violation. Each workforce member signs an acknowledgment, which turns the document into an employee acceptable use agreement that the organization can enforce and an assessor can test.

In a typical policy set, the acceptable use policy sits beneath the information security policy. The information security policy states what the organization commits to protect and who is responsible; the acceptable use policy states what each individual user must do and must not do to honor that commitment. For a defense contractor handling controlled unclassified information (CUI), a medical practice handling protected health information (PHI), a SOC 2 service organization, a merchant with a cardholder data environment, or a financial firm under the FTC Safeguards Rule, the AUP is one of the first documents an assessor asks for, because it is the evidence that users were told the rules before they were held to them. A policy that is missing, generic, unsigned, or contradicted by what the systems actually allow is a finding waiting to be written.

This page is for the business owner, office manager, compliance lead, or IT director at a small or mid-size regulated organization who needs a usable acceptable use policy template now, needs to understand what each section is for, and wants to know how to enforce it with technology rather than hope. Petronella Technology Group, Inc. has served clients in Raleigh, Durham, Cary, Chapel Hill, and across North Carolina since 2002, and the template below is the same structure we start from in client engagements, whether the client is preparing for a CMMC Level 1 self-assessment or a full SOC 2 Type II examination.

What an Acceptable Use Policy Must Cover

Most acceptable use policy examples you will find online are two pages of HR language that say "use good judgment," "do not visit inappropriate websites," and "the company may monitor your activity." None of those statements is specific enough for a technician to configure or for an auditor to verify. A policy that works for a regulated business needs the sections below, each stating something concrete that can be enforced by a control and evidenced by a record. The table also shows why each section earns its place, which is useful when a manager asks why the policy is so long.

Free Acceptable Use Policy Template

The template below is written to be adopted. Replace every bracketed placeholder, delete any clause that genuinely does not apply, and have your employment counsel review Sections 4, 11, and 12 before you publish, because state law on employee monitoring, incidental personal use, and discipline varies. The template is deliberately framework-neutral so that a defense contractor, a dental practice, a SaaS company, and a credit union can each start from the same text. The framework section that follows tells you which clauses to tighten for your situation. Where the template refers to another [Company Name] policy, such as the Data Classification Policy, the BYOD Policy, or the AI Acceptable Use Policy, adopt those documents too or fold the relevant rules into this one.

1. Purpose

[Company Name] provides computers, mobile devices, networks, accounts, software, cloud services, and data to its workforce for the purpose of conducting [Company Name] business. This Acceptable Use Policy establishes the rules that every user must follow when using those resources, so that [Company Name] can protect the confidentiality, integrity, and availability of its information and systems; meet its obligations under [applicable frameworks, for example NIST SP 800-171 and CMMC 2.0, the HIPAA Security Rule, SOC 2, PCI DSS, ISO/IEC 27001, the FTC Safeguards Rule]; protect its customers, patients, partners, and employees; and reduce legal, regulatory, financial, and reputational risk. This policy implements the user responsibilities described in the [Company Name] Information Security Policy and should be read together with the [Company Name] Data Classification Policy, BYOD Policy, AI Acceptable Use Policy, and Incident Response Plan. Where this policy conflicts with a less restrictive statement elsewhere, this policy governs for the use of [Company Name] resources.

2. Scope

This policy applies to all employees, officers, contractors, consultants, interns, temporary staff, volunteers, vendors with system access, and any other person (collectively, "Users") who accesses, uses, or administers any [Company Name] information system, account, network, application, device, or data, whether the resource is owned by [Company Name], leased, hosted by a third party, or personally owned and used for [Company Name] business. It applies at every location, including [Company Name] offices, customer or patient sites, home offices, vehicles, and public places, and at all times, including outside normal working hours. It applies to all [Company Name] data regardless of format or storage location, including data held in email, messaging platforms, cloud storage, software-as-a-service applications, removable media, paper, and artificial intelligence tools. Systems that process controlled unclassified information, protected health information, cardholder data, or data classified as Confidential or Restricted are additionally governed by the [Company Name] Data Classification Policy and any system-specific rules documented in the [Company Name] System Security Plan.

3. Definitions

For the purposes of this policy, the following terms have the following meanings. "Company System" means any computer, server, network device, mobile device, storage device, printer, telephone system, account, application, or cloud service owned, leased, licensed, administered, or paid for by [Company Name], and any personally owned device while it is used to access Company Data. "Company Data" means any information created, received, stored, processed, or transmitted in the course of [Company Name] business, in any format, regardless of where it is stored or who holds it. "Regulated Data" means Company Data subject to a legal, regulatory, or contractual protection requirement, including controlled unclassified information (CUI), federal contract information (FCI), protected health information (PHI), cardholder data, nonpublic personal information under the Gramm-Leach-Bliley Act, personally identifiable information, and any data classified as Confidential or Restricted under the [Company Name] Data Classification Policy. "Authorized Use" means use of a Company System for [Company Name] business purposes by a User who has been granted access through the [Company Name] onboarding and access provisioning process, within the limits of the access that was granted. "Approved Software" and "Approved Service" mean software, browser extensions, mobile applications, cloud services, and artificial intelligence tools that appear on the [Company Name] approved list maintained by [IT Contact], or that have been approved in writing through the exception process in Section 12. "Personal Device" means any computing device not owned or issued by [Company Name]. "Removable Media" means USB flash drives, external hard drives, memory cards, optical discs, and any other portable storage device. "Monitoring" means the collection, logging, retention, and review of information about the use of Company Systems, including network traffic, web requests, email metadata and content, file access, authentication events, and endpoint activity. "Security Incident" means any actual or suspected unauthorized access, use, disclosure, modification, loss, or destruction of Company Data or Company Systems, including lost or stolen devices, malware infections, successful phishing, and policy violations that could expose Company Data.

4. Ownership and Authorized Use

All Company Systems and all Company Data are the property of [Company Name], including data that a User creates, sends, receives, or stores using a Company System, and including messages and files in accounts assigned to a User. Users have no expectation of privacy in anything created, stored, sent, or received on a Company System, subject to the specific monitoring notice in Section 11 and applicable law. Company Systems are provided for Authorized Use. Users may use Company Systems only for the access and purposes they have been authorized for, and must not attempt to access systems, data, accounts, or physical areas beyond that authorization, even if a technical control would permit it. [Company Name] permits limited, incidental personal use of Company Systems, such as reading personal email in a web browser or making a brief personal call, provided that such use is lawful, does not interfere with job duties or the duties of others, does not consume significant resources, does not involve any Prohibited Activity in Section 12, does not create cost or liability for [Company Name], and does not involve storing personal files on Company Systems or Company Data in personal accounts. [Company Name] may withdraw permission for incidental personal use at any time, for any User or for all Users. Users must not represent personal opinions as those of [Company Name] when using Company Systems or when identifying themselves as [Company Name] personnel on external websites, forums, or social media. Users must lock or log off from any Company System before leaving it unattended, must position screens so that Regulated Data cannot be viewed by unauthorized persons, and must not leave printed Regulated Data unattended at printers, desks, or in vehicles. Workstations and devices located in areas accessible to the public or to visitors must be secured as described in the [Company Name] workstation security procedures.

5. Accounts, Passwords, and Authentication

Each User is issued unique credentials and is accountable for all activity performed with them. Users must not share credentials with any other person, including supervisors, coworkers, family members, and IT staff; [Company Name] support personnel will never ask a User for a password. Users must not use another person's credentials, must not allow another person to use a session they have authenticated, and must not use shared or generic accounts except where [IT Contact] has documented a specific business need and compensating controls. Passwords and passphrases must meet the length, complexity, history, and rotation requirements configured in the [Company Name] identity platform and published by [IT Contact], and must not be reused across [Company Name] accounts or between [Company Name] accounts and personal accounts. Users must not write passwords on paper kept near a device, store passwords in unencrypted files, browser notes, or messaging apps, or send passwords by email or text message. [Company Name] provides an approved password manager, and Users must store [Company Name] credentials only in that manager or in the [Company Name] identity platform. Multi-factor authentication is required for all [Company Name] accounts that support it, and Users must enroll an approved authenticator before access is granted. Users must not approve a multi-factor authentication prompt they did not initiate, and must report unexpected prompts to [IT Contact] as a Security Incident. Users must configure devices to lock automatically after no more than [number] minutes of inactivity and must manually lock devices when stepping away. Users must change any password they suspect has been exposed immediately and notify [IT Contact]. Access rights are granted on the basis of job role through the [Company Name] onboarding process, are reviewed [quarterly / semiannually], and are removed through the [Company Name] offboarding process on or before the separation date. Users must not attempt to elevate their privileges, disable security software, bypass authentication, or circumvent any access control.

6. Email, Messaging, and Collaboration Tools

Users must conduct [Company Name] business only through the email, messaging, video conferencing, and collaboration platforms that [Company Name] provides and lists as Approved Services. Users must not use personal email accounts, personal messaging applications, personal video conferencing accounts, or personal file sharing services to send, receive, store, or discuss Company Data, and must not auto-forward [Company Name] email to any external address. Regulated Data may be sent outside [Company Name] only to authorized recipients, only when the business purpose requires it, and only using the encryption method designated for that data class by the [Company Name] Data Classification Policy, such as [encrypted email service, secure file transfer portal, or approved client portal]. Users must verify the recipient address before sending Regulated Data and must report misdirected messages as a Security Incident. Users must not open attachments or follow links in unexpected or suspicious messages, must not respond to requests for credentials, payments, gift cards, wire transfers, or changes to banking details without verifying the request through a known telephone number or in person, and must report suspected phishing using the [report button / phishing mailbox] within [number] hours. Users must not send messages that are harassing, discriminatory, threatening, defamatory, obscene, or that would violate the [Company Name] code of conduct if spoken aloud in the workplace. Users must not send unsolicited bulk email, chain messages, or messages that misrepresent the sender. Users must use the [Company Name] email signature and disclaimer where configured. Email and messaging on Company Systems are retained in accordance with the [Company Name] records retention schedule and may be subject to legal hold; Users must not delete messages that are subject to a hold notice. Users must not record meetings or calls without the consent required by applicable law and [Company Name] procedure.

7. Internet and Web Use

Internet access through Company Systems is provided for business purposes and is filtered, logged, and monitored as described in Section 11. [Company Name] blocks categories of websites that present security, legal, productivity, or reputational risk, including known malicious sites, sites that distribute pirated content, adult content, gambling, and categories designated by [IT Contact]. The presence or absence of a block does not make a site acceptable or unacceptable; Users remain responsible for complying with this policy regardless of the filter's configuration. Users must not attempt to bypass web filtering, proxy, DNS, or firewall controls through the use of personal hotspots on company devices, anonymizing proxies, virtual private network services not provided by [Company Name], browser configuration changes, or any other means. Users must not visit, download from, or upload to sites that contain or distribute malware, pirated software, pirated media, or content that is illegal, obscene, or that would create a hostile work environment. Users must not stream video or audio, download large files, or run peer-to-peer applications for personal purposes on Company Systems or networks. Users must not post Company Data, including screenshots, documents, images of the workplace, or descriptions of customers, patients, projects, or systems, on any public website, social media platform, forum, code repository, or paste site, and must not post CUI or other Regulated Data on any publicly accessible system under any circumstances. Users who maintain a personal web presence must make clear that their views are their own and must not disclose confidential information. Users must not use Company Systems to operate a personal business, conduct political campaigning, or solicit for causes not sponsored by [Company Name]. Users must not download files from the internet except from sources approved by [IT Contact] and only as needed for business purposes.

8. Software, Cloud Services, and AI Tools

Users may install, run, or use on Company Systems only Approved Software and Approved Services. Users must not install, download, or run software, browser extensions, scripts, mobile applications, or operating system modifications that are not on the approved list, must not disable or modify security software, agents, updates, or configuration settings deployed by [IT Contact], and must not connect unapproved hardware, including personal routers, wireless access points, storage devices, and keyboard or network adapters, to Company Systems or networks. Users must not use software in violation of its license, must not copy licensed software for use on unlicensed devices, and must not use pirated or cracked software of any kind. Requests for new software or services must be submitted to [IT Contact] through the [ticketing system or request form], and will be evaluated for security, licensing, data handling, and compliance before approval; software that will store or process Regulated Data additionally requires approval from [Compliance Contact] and, where applicable, a signed agreement with the vendor such as a business associate agreement. Users must not sign up for, pay for, or use any cloud service, software-as-a-service application, file sharing service, note-taking service, or productivity tool with Company Data unless it is an Approved Service, regardless of whether the service is free or paid for personally. Users must not enter, upload, paste, dictate, or otherwise provide Company Data to any artificial intelligence chatbot, assistant, transcription service, translation service, code assistant, image generator, or similar tool unless that tool is an Approved Service and the data class is permitted for that tool under the [Company Name] AI Acceptable Use Policy. In particular, Regulated Data, including CUI, PHI, cardholder data, nonpublic personal information, source code, credentials, legal matters, personnel information, and unreleased financial information, must never be provided to a consumer AI tool or to any AI feature embedded in an unapproved application or browser. Users must not enable AI features, plug-ins, or integrations within Approved Services without approval from [IT Contact], because such features may transmit data to third parties outside the approved agreement. Users must not use Company Systems to develop, test, or run security tools, scanners, or exploits except as part of an authorized role. [IT Contact] maintains the approved list, reviews it at least [quarterly], and may remove software or services at any time; Users will be notified and must cease use within the period stated in the notice.

9. Data Handling, Classification, and Removable Media

Users must handle Company Data in accordance with its classification under the [Company Name] Data Classification Policy, which defines the classes [Public, Internal, Confidential, Restricted] and the handling rules for each. Users must store Company Data only in the storage locations approved for its class, such as [approved file server, approved cloud storage tenant, approved line-of-business application], and must not store Company Data on the local drive of a device, on a Personal Device, in a personal account, or in any location not approved for that class. Users must not store Regulated Data in email folders, chat histories, downloads folders, desktop folders, or screenshots as a substitute for the approved system of record. Users must transmit Regulated Data only through the methods approved for its class and must not transmit it through unencrypted email, consumer messaging, text message, fax to an unverified number, or any AI tool. Users must not print Regulated Data unless the business purpose requires it, must retrieve printouts immediately, must store printed Regulated Data in locked storage when not in use, and must dispose of it only through the [Company Name] shredding or secure destruction process. Users must not photograph or record screens displaying Regulated Data. Use of Removable Media on Company Systems is [prohibited / restricted to encrypted devices issued by IT Contact for a documented business purpose]; Users must not connect personally owned Removable Media, found or gifted Removable Media, or any unencrypted Removable Media to a Company System, and must not use Removable Media or Personal Devices to store or transport CUI or other Regulated Data. Users must not copy Company Data to any external system, including a customer's or partner's system, except through approved interfaces and for authorized purposes. Users must return all Company Data and Company Systems upon separation or upon request, and must not retain copies in any form. Where a User identifies Company Data that appears to be stored, shared, or transmitted in violation of this section, the User must report it to [IT Contact] rather than attempt to correct it alone.

10. Remote Work and Personal Devices

Users may access Company Systems from outside [Company Name] facilities only through the remote access methods that [IT Contact] has approved, such as [identity-aware access gateway, zero trust access client, managed virtual desktop, or company-managed VPN], and only from devices that meet the requirements of this section. Users must not use remote desktop, file sharing, screen sharing, or other remote access tools that have not been approved, and must not expose any Company System to the internet directly. Users must not connect Company Systems to public or untrusted wireless networks, including hotel, airport, coffee shop, and conference networks, unless the approved remote access method is active and encrypting all traffic; where a cellular hotspot is available, Users must prefer it. Users working from home must use a wireless network protected by a current encryption standard and a non-default password, must keep home routers updated, and must not allow household members or guests to use Company Systems. Users must not work with Regulated Data in locations where screens or conversations can be observed or overheard by unauthorized persons, and must use a privacy screen when working with Regulated Data in public. Company-issued devices must remain under the User's physical control or locked in a secure location, must not be left visible in a vehicle, and must not be checked as luggage. Users may use a Personal Device for [Company Name] business only if they have enrolled in the [Company Name] BYOD program, signed the BYOD Policy acknowledgment, and the device meets the security requirements stated there; personal laptops and desktops are [prohibited / permitted only through the managed virtual desktop]. Where [Company Name] handles CUI, CUI must be accessed, processed, and stored only on [Company Name] owned and managed devices within the authorized boundary described in the System Security Plan, and never on a Personal Device, through a personal account, or on a public computer. Users must not print Company Data at home or at commercial print services unless approved for that data class. Users must report a lost or stolen device, whether company-issued or personal, to [IT Contact] immediately and in no case later than [number] hours after discovering the loss.

11. Monitoring and Privacy Notice

This section is [Company Name]'s written notice to Users that their use of Company Systems is monitored. [Company Name] logs, retains, and may review the following: authentication events, including sign-in time, location, device, and success or failure; network traffic metadata and the websites and services requested through [Company Name] networks, devices, and DNS and web filtering services; email and messaging content and metadata on [Company Name] platforms; files created, accessed, modified, shared, downloaded, uploaded, printed, or deleted on Company Systems; software installed and processes running on company-managed devices; endpoint security telemetry collected by the [Company Name] endpoint detection and response agent; and the configuration and compliance state of enrolled devices. Monitoring is performed through automated security tools and by [IT Contact], [Company Name]'s managed security provider, and [Compliance Contact], for the purposes of protecting Company Systems and Company Data, detecting and investigating Security Incidents, verifying compliance with this policy and with law, meeting legal and regulatory obligations, and supporting business continuity. [Company Name] may access, preserve, and disclose the contents of any Company System or account, including email, files, and messages, without further notice to the User, where [Company Name] determines it is necessary for those purposes or is required by law, legal process, or contract. Monitoring applies to incidental personal use of Company Systems; Users who wish to keep personal matters private should use a personal device and personal account on a personal network. [Company Name] does not monitor personal content on Personal Devices enrolled in the BYOD program beyond the managed work profile, as described in the BYOD Policy. [Company Name] does not monitor Users through webcams or microphones except during meetings the User has joined, and does not use keystroke logging except where [legal counsel] has approved it for a specific investigation. Monitoring records are retained for [retention period] in accordance with the [Company Name] records retention schedule and are protected as Confidential data. Where applicable state law requires a separate written or electronic acknowledgment of this monitoring notice, Users will be asked to provide it at hire and [annually], and the notice will be posted [in the employee handbook and on the company intranet]. Questions about this notice should be directed to [HR Contact] or [legal counsel].

12. Prohibited Activities, Reporting Obligations, and Enforcement

In addition to the specific rules above, the following activities are prohibited on Company Systems and in connection with Company Data, except where explicitly authorized in writing as part of a User's role: accessing, copying, modifying, or deleting data, accounts, or systems without authorization; attempting to defeat, disable, or test security controls, including port scanning, password cracking, packet capture, and vulnerability scanning; introducing malware or any code intended to damage, disrupt, or surveil; using Company Systems to attack, probe, or disrupt any other system; impersonating another person or organization, or spoofing email addresses or caller identification; harassing, discriminating against, threatening, or defaming any person; creating, viewing, storing, or distributing obscene or sexually explicit material; infringing copyright, trademark, patent, or trade secret rights, including the use of pirated software and media; engaging in gambling, fraud, or any unlawful activity; disclosing Company Data or Regulated Data to any person not authorized to receive it; using Company Systems for a personal business or for the benefit of a competitor; soliciting, campaigning, or fundraising for causes not sponsored by [Company Name]; connecting unauthorized devices or networks; and any activity that exposes [Company Name] to legal liability or reputational harm. Every User must report any Security Incident, suspected policy violation, lost or stolen device, misdirected message, unexpected multi-factor prompt, or suspected phishing to [IT Contact] at [phone and email] immediately, and in no case later than [number] hours after discovery, following the [Company Name] Incident Response Plan. Users must cooperate with investigations, must preserve evidence as directed, and must not attempt to investigate, remediate, or conceal an incident on their own. [Company Name] will not retaliate against a User for a good-faith report, including a report of the User's own mistake, and treats prompt self-reporting as a mitigating factor. Compliance with this policy is a condition of access to Company Systems. Violations are investigated by [IT Contact], [HR Contact], and, where appropriate, [legal counsel], and may result in suspension or revocation of access, mandatory retraining, written warning, suspension, termination of employment or engagement, pursuit of civil remedies, and referral to law enforcement, in accordance with [Company Name] disciplinary procedures and applicable law. Sanctions are documented and retained as required by the frameworks [Company Name] operates under. Where a violation also constitutes a breach of law or contract, [Company Name] may be obligated to notify regulators, customers, patients, or contracting officers. Exceptions to this policy may be granted only in writing by [IT Contact] and [Compliance Contact], must be documented with a business justification, an expiration date, and compensating controls, and are reviewed at least annually. This policy is reviewed at least annually, and whenever there is a material change in [Company Name]'s regulatory obligations, systems, or tooling; Users will be notified of revisions and must re-acknowledge the policy [annually and upon material revision]. Questions about this policy should be directed to [IT Contact].

Employee Acknowledgment

I, [Employee Name], acknowledge that I have received, read, and understand the [Company Name] Acceptable Use Policy dated [date]. I understand that the Company Systems and Company Data I use belong to [Company Name], that my use of them is monitored as described in Section 11, and that I have no expectation of privacy in their use except as stated in that section. I agree to use only approved software, cloud services, and AI tools; to protect my credentials and never share them; to handle Company Data according to its classification; to follow the remote work and personal device rules; and to report security incidents and suspected violations within the window stated in Section 12. I understand that violation of this policy may result in loss of access and disciplinary action up to and including termination, and that I may be required to re-acknowledge this policy annually or upon revision. I confirm that I have completed the [Company Name] security awareness training associated with this policy.

Employee signature: ____________________ Date: __________
Printed name: ____________________ Role or title: ____________________
Department: ____________________ Manager: ____________________
Training completed on: __________ Acknowledgment witnessed by (HR or IT): ____________________ Date: __________

Store the signed acknowledgment with the employee's onboarding record alongside the training completion certificate. If you use ComplianceArmor, the acknowledgment and the training record can be filed against the relevant control so an assessor can retrieve both in one place, and the platform will flag workforce members whose annual re-acknowledgment is overdue. The employee onboarding checklist should list the acknowledgment as a step that precedes account provisioning, and the employee offboarding checklist should reference Section 9's return-of-data obligation.

How to Customize the Template by Framework

The template above is framework-neutral. The table below shows which sections carry the weight for each framework our clients operate under, and what to tighten. The control identifiers are the ones assessors will reference when they ask to see your acceptable use policy, so it is worth citing them in the policy's purpose statement or in your system security plan. As Craig Petronella details in his CMMC 2.0 Certification Guide, the NIST SP 800-171 control families that touch user behavior most directly are Access Control, Awareness and Training, Configuration Management, Media Protection, and Personnel Security, and the acceptable use policy is where those families meet the individual user.

The honest answer on acceptable use and CUI

Defense contractors in the Triangle often come to us with a policy inherited from a staffing agency or a generic HR handbook. It typically says nothing about CUI, nothing about external systems, nothing about user-installed software, and nothing about AI tools. Under NIST SP 800-171 and CMMC 2.0, the acceptable use policy is not itself a control, but it is the document that puts users on notice of the behaviors that controls 3.1.1, 3.1.20, 3.1.21, 3.1.22, 3.4.9, and 3.8.7 depend on. An assessor who finds that users were never told they may not paste contract data into a consumer chatbot, or never told that USB drives are prohibited, will reasonably question whether those controls are implemented in practice rather than only in configuration. Write the CUI-specific clauses into Sections 8, 9, and 10, cite the control numbers in Section 1, and keep the signed acknowledgments with your system security plan. If you are planning for the Rev 3 transition, our NIST SP 800-171 Rev 3 guide covers what changes for user-facing requirements. The SPRS calculator can help you see how the affected controls move your score.

Medical practices in Durham, Chapel Hill, and Cary face a different emphasis. As Craig Petronella details in "How HIPAA Can Crush Your Medical Practice," the Security Rule's workstation use and workstation security standards are where small practices most often fall short, not because the safeguards are difficult but because nobody wrote down what staff are supposed to do at the front desk, in the exam room, and at home. Sections 4, 10, and 11 of the template are the place to write it down, and the sanction policy in Section 12 is what OCR expects to see applied when someone does not follow it. The broader context is on our HIPAA compliance page and in the information access management guidance.

Acceptable Use Policy vs Information Security Policy vs BYOD Policy

These three documents are often confused, and some organizations try to make one of them do all three jobs. They govern different things, are signed by different people, and reference each other in a specific direction. The acceptable use policy and the BYOD policy are user-facing and signed; the information security policy is organization-facing and approved by leadership. All three depend on the data classification policy to define the data classes they refer to, and all three should point to the AI acceptable use policy for the rules on artificial intelligence tools rather than each inventing its own.

If you need the parent document, our IT documentation service produces the information security policy and the rest of the policy set, and a virtual CISO engagement is the usual way smaller organizations get the policy set owned and maintained rather than written and forgotten.

Petronella Technology Group is rated 4.7 across 92 verified TrustIndex reviews and 5.0 across 15 Google reviews.

Risks the Policy Has to Address

Each of the following risks maps to a section in the template. If your current policy does not speak to one of them, that is the section to rewrite first. As Craig Petronella details in "How Hackers Can Crush Your Business," the attacker's easiest route into a small company is rarely a sophisticated exploit; it is an employee doing something ordinary with a system that was never configured to stop them and a policy that never told them not to. The acceptable use policy is where the organization closes that gap on the human side.

Shadow IT and unapproved cloud storage

A project manager who finds the approved file server slow signs up for a free personal cloud storage account and shares a folder with the team. A sales representative installs a browser extension that promises to summarize emails. A bookkeeper uses a free online PDF converter on a vendor invoice containing bank details. None of these people intends harm, and all of them have just moved Company Data to a third party with no agreement, no logging, and no way for the organization to retrieve or delete it. Section 8 of the template makes the approved list the only list, and the application allow-listing and web filtering controls described later make the rule structural rather than aspirational. For CUI, these services are external systems under NIST SP 800-171 3.1.20, and their use is a finding regardless of intent.

Shadow AI: consumer chatbots with regulated data

The newest and fastest-growing version of shadow IT is the consumer AI assistant. Staff paste patient notes to draft a letter, upload a contract drawing to ask a question about tolerances, or feed a customer list into a tool to clean the formatting. In each case Regulated Data has left the organization and may be retained by the provider, used to improve the model, or exposed through a later breach of that provider. The template's Section 8 prohibits providing Company Data to any AI tool that is not an Approved Service, and prohibits Regulated Data in consumer AI tools under any circumstances. Because the landscape changes quickly, the detailed rules belong in a separate AI acceptable use policy that the AUP references, and the technical side belongs to shadow AI detection, which identifies which AI services your workforce is already using so the approved list reflects reality. Organizations that want a structured way to decide which AI tools to approve should start with an AI governance framework rather than approving tools one request at a time.

Personal email and messaging of company data

Forwarding work email to a personal account "so I can read it on my phone," texting a photo of a document to a coworker, or discussing a patient in a consumer messaging group are all ways Company Data ends up in places the organization cannot see, retain, produce in litigation, or wipe when the employee leaves. Section 6 prohibits personal accounts and auto-forwarding, requires the approved encryption method for Regulated Data, and sets the phishing reporting duty. Conditional access and mail flow rules in the email platform enforce the auto-forward prohibition, and data loss prevention rules catch Regulated Data leaving through unapproved channels.

Removable media

USB drives are small, cheap, easily lost, rarely encrypted, and a well-known delivery mechanism for malware. A drive found in a parking lot and plugged in out of curiosity is a classic initial access technique, and a drive used to carry a project folder home is an unencrypted copy of Company Data outside every control you have. Section 9 states the removable media position, and NIST SP 800-171 3.8.7 and 3.1.21 both expect the organization to control it. For most regulated clients we recommend blocking USB storage on managed endpoints and saying so in the policy, with an exception process for the few roles that need an encrypted, issued drive.

Remote work and public Wi-Fi

Working from a hotel, an airport, or a coffee shop puts the device on a network the organization does not control and often puts the screen within view of strangers. A home office adds an unmanaged router, household members, and printers. Section 10 requires the approved remote access method on every untrusted network, sets home network expectations, requires privacy screens for Regulated Data in public, and prohibits exposing Company Systems directly to the internet. The architecture that makes those rules enforceable is an identity-aware access model rather than a traditional VPN that drops any authenticated device onto the internal network; see zero trust vs VPN for the comparison.

Credential sharing

A front desk shares one login because the system is slow to switch users. A manager gives a password to an assistant to check email during vacation. A departing employee's account stays active because a coworker "still needs the files." Every one of these breaks the link between an account and a person, which is the foundation of access control under NIST SP 800-171 3.1.1 and of every audit log you will ever rely on in an investigation. Section 5 prohibits sharing without exception, requires multi-factor authentication, and tells users what to do about unexpected authentication prompts. Multi-factor authentication tied to an individual's device is the technical control that makes credential sharing inconvenient enough to stop.

Software piracy and licensing

Unlicensed software exposes the organization to vendor audits, statutory damages, and the malware that commonly rides along with cracked installers. It also means the software is not receiving updates. Section 8 prohibits unlicensed software and unapproved installations, and the technical enforcement is application allow-listing combined with a software inventory report, which also happens to be the evidence for NIST SP 800-171 3.4.9. Keep a record of licenses alongside the approved list so the allow-list and the entitlement match.

Harassment and legal exposure

Email, chat, and shared drives are discoverable, and content that would be unacceptable spoken aloud is equally unacceptable typed. Harassing messages, offensive material viewed on a shared screen, and defamatory posts made from a company account create employment claims and reputational damage. Sections 6, 7, and 12 prohibit this conduct explicitly and tie it to the code of conduct, which gives HR a clear basis for discipline and gives the organization a documented position if a claim is made. Web filtering of adult and hate content is the supporting control, and the monitoring notice in Section 11 is what allows the organization to investigate complaints using its own records.

Monitoring without notice

An organization that monitors email, web activity, and endpoint behavior without telling its workforce in writing creates two problems. The first is legal: several states require employers to give written notice of electronic monitoring, and the specifics of what must be disclosed and how vary, so the organization should have counsel confirm the requirements where its employees work. The second is trust: employees who discover monitoring they were not told about assume the worst about its scope. Section 11 is written as a specific notice that lists what is logged, who reviews it, for what purposes, and what is not monitored, which satisfies the notice requirement in the states that have one and sets accurate expectations everywhere else. The notice should match what the Managed XDR Suite and your other tools actually collect; a notice that overstates or understates the monitoring is a problem in either direction.

Enforcing the Policy: Technical Controls That Back the Words

An acceptable use policy is a set of statements about what users will and will not do. Technology is how you make most of those statements true without relying on memory and goodwill. The following controls are what we deploy for clients, and each one corresponds to a "must" or "must not" statement in the template. When the policy and the controls match, the policy becomes documentation of the environment rather than a wish list, and an assessor can test it by looking at a console instead of interviewing staff.

DNS and web filtering (Sections 7, 8)

A DNS and web filtering service blocks the categories Section 7 names, blocks newly registered and known malicious domains, and can block or alert on the unapproved cloud storage, file sharing, and AI services that Section 8 prohibits. Because filtering follows the device rather than the office network, it applies to remote workers as well. The filter's reporting is also how you discover which shadow services staff are already using, which should inform the approved list before you publish the policy rather than after.

Conditional access (Sections 5, 10)

Conditional access in the identity platform evaluates every sign-in and requires multi-factor authentication, a managed and compliant device, and an expected location or risk level before granting access to email, files, and applications. It is what makes Section 5's multi-factor requirement and Section 10's approved-method requirement enforceable, because an unapproved device or a legacy protocol simply cannot authenticate. It also blocks the auto-forwarding and legacy mail client paths that Section 6 prohibits.

Application allow-listing (Section 8)

Allow-listing permits only approved applications, installers, scripts, and browser extensions to run on managed endpoints and blocks everything else by default. It is the technical control behind Section 8's approved-software rule and the evidence for NIST SP 800-171 3.4.9. Combined with the removal of local administrator rights, it ends the practice of users installing whatever a website suggests, and the request path in Section 8 gives them a legitimate way to get what they need.

Data loss prevention (Sections 6, 9)

Data loss prevention rules identify Regulated Data by pattern and label and block or warn when it is emailed to an external personal domain, uploaded to an unapproved cloud service, pasted into a browser-based AI tool, copied to removable media, or printed. DLP is the enforcement for the data-class handling rules in Section 9 and the transmission rules in Section 6, and it depends on the classification scheme from your data classification policy being applied to the data in the first place.

Mobile device management (Section 10)

Mobile device management enforces encryption, screen lock, supported operating system versions, and the approved application catalog on company-issued devices, and creates the managed work profile on enrolled personal devices. It is what makes Section 10's device requirements and the BYOD Policy's promises true, and its compliance reporting is the evidence for NIST SP 800-171 3.1.18 and the HIPAA device safeguards.

Logging and monitoring (Sections 11, 12)

Endpoint detection and response, identity sign-in logs, email audit logs, and web filter logs are the records Section 11 tells users exist. Centralizing them in the Managed XDR Suite, watched by our security operations center, is what turns those records into detection: a user disabling the security agent, a mass download before a resignation, a sign-in from an impossible location, or a device suddenly connecting to a consumer file sharing service all generate alerts that are investigated. The same logs are what make Section 12's investigation and sanction process factual rather than anecdotal, and they feed the incident response plan when a violation becomes an incident.

Security awareness training and phishing simulation (Sections 5, 6, 12)

Training is how users learn what the policy means in practice, and it is a named requirement under NIST SP 800-171 3.2.1, the HIPAA Security Rule, and the FTC Safeguards Rule. Our security awareness training covers the password, phishing, data handling, and AI tool rules in the template, and recurring phishing simulation measures whether the Section 6 reporting habit has actually formed. If you want a starting measurement before you roll out the policy, the free phishing security test shows how your workforce responds today.

Acknowledgment tracking and evidence (Acknowledgment, Section 12)

The signed acknowledgment, the training record, the approved software list, the filter and DLP configuration, and the sanction log are the artifacts an assessor asks for. ComplianceArmor, Petronella Technology Group's proprietary compliance documentation platform, tracks policy acknowledgments by workforce member, flags overdue re-acknowledgments, files the acceptable use policy against the relevant NIST SP 800-171, HIPAA, SOC 2, PCI DSS, and ISO 27001 controls, and keeps the evidence in one place that can be queried during an assessment rather than reconstructed from HR folders and ticket queues. Its SSP generator pulls the policy references into the system security plan, and its gap analysis, evidence collection, and continuous monitoring modules keep the policy and the environment aligned between annual reviews.

Common Acceptable Use Policy Mistakes

These are the problems we find most often when a new client hands us their existing acceptable use policy, and what we change.

Three Ways to Get an Acceptable Use Policy: An Honest Comparison

You can write the policy yourself from the template above, you can buy a generic policy-template package, or you can have Petronella Technology Group write it and enforce it. All three produce a document. They differ in whether the document matches your framework, whether it matches your systems, and whether anyone is accountable for keeping the two aligned over time.

Our Approach to Acceptable Use Policy and Enforcement

For clients who engage Petronella Technology Group to build the program rather than just the document, the work runs in six steps. The sequence matters: the policy is written after we know what systems, services, and data classes exist, not before, so the approved list and the prohibitions reflect the real environment. The same sequence applies whether the engagement is led by our CMMC consultant team for a defense contractor or by our HIPAA team for a practice, and it begins with the same compliance risk assessment that scopes the rest of the policy set.

This page was written by Craig Petronella, MIT-certified cybersecurity professional, CMMC Registered Practitioner, and author of "How Hackers Can Crush Your Business" and "CMMC 2.0 Certification Guide," both available with his other titles on our books page. The approach reflects what we have learned writing and enforcing policies for regulated clients across the Triangle and nationwide, and it connects to the rest of our compliance services and cybersecurity services. For a broader view of what a small or mid-size business should have in place this year, download the free 2026 SMB Cybersecurity Survival Guide, and if you are working toward SOC 2, the SOC 2 compliance checklist shows where the acceptable use policy fits among the other required documents.

Frequently Asked Questions

Written by Craig Petronella, CMMC Registered Practitioner and NC Licensed Digital Forensics Examiner (License 604180-DFE), founder of Petronella Technology Group, Inc. in Raleigh, North Carolina. The template references NIST SP 800-171 Rev. 2 and the HIPAA Security Rule as published by the U.S. Department of Health and Human Services. Learn more about Petronella Technology Group. Questions about this template can be sent to info@petronellatech.com or 919-348-4912.