An acceptable use policy (AUP), also called a fair use policy (FUP), is a document that explicitly states the behaviors that are permitted, restricted, or prohibited when using technology resources at a company. It clearly specifies what employees can and cannot do while protecting workplaces from security risks and legal liabilities.
It is best practice for employers to create an acceptable use policy and include it in their employee handbook. An AUP provides a digital code of conduct for all workers regarding acceptable and unacceptable behavior when using computers, devices, networks, AI, and other technology. It teaches employees proper safety protocols and how to avoid unacceptable behaviors that could result in a significant data breach, leaving the company vulnerable.
Why Are Acceptable Use Policies Necessary?
AUPs provide a set of digital guardrails that help protect both employers and employees, while managing risks and ensuring compliance with data regulations. In addition to educating employees, AUPs proactively protect the company from cybersecurity risks and legal liabilities. The document also informs employees of the consequences for violations. Disclaimers used in AUPs can protect the organization from being held responsible for data breaches.
When simple and practical language is used, employers can prevent confusion and misunderstandings among employees. Employers can boost employee productivity by ensuring that company devices and internet access are used strictly for work-related purposes, not personal activities. Without an AUP, companies can be held liable and sued for illegal actions performed by employees and data breaches.
Laws Impacting an Acceptable Use Policy
While acceptable use policies are not mandated by law, there are federal laws designed to balance company rights while protecting employees from undue surveillance and privacy invasion.
Electronic Communications Privacy Act (ECPA): This law bans the unauthorized interception of electronic communications and protects an employee’s reasonable expectation of privacy when using company equipment.
Stored Communications Act (SCA): This law maintains the privacy of digital communications housed on servers. To protect employee data, employers need proper authorization before accessing stored communications.
Data protection laws: From credit card processing laws to HIPAA laws to protect healthcare data, employers must have effective procedures in place to safeguard data.
“The ECPA and the SCA create a legal framework that limits the extent to which employers can monitor employee communications and access stored data,” reports Leppard Law. By creating clear AUP policies, being transparent about employee monitoring, and obtaining employee consent, employers can safely address these legal boundaries.
Key Elements of AUPs
AUPs include many different elements, such as privacy, security, compliance, and monitoring. The policy should be tailored to each organization and include acceptable guidelines, prohibited activities, and consequences for violations.
Describe acceptable use guidelines, explaining how employees should utilize company technology while adhering to secure practices. Provide details and examples of prohibited activities and unacceptable use. Specify the exact consequences for violations. Include a range of consequences based on the severity of the violation. Penalties can range from warnings to employee terminations and reports to law enforcement. Identify how employees can report violations, as well as how and when to report attempted breaches and phishing.
Explain security measures that will be used to keep company data safe, including how frequently to update secure passwords and utilize two-factor authentication (2FA). Define the security procedures for installing new software once proper authorization is received.
The more clarity employers provide, the more effective the policy will be for employees. The policy should also include transparency about how the employer will monitor digital usage.
Areas Covered in AUPs
The growth of remote and hybrid workers, combined with emerging technologies, means more areas for employers to address in AUPs. A comprehensive AUP policy covers activities by all employees, contractors, and temporary staff in the following areas:
Computer use and devices: Policies about computer use and devices should apply to both company-issued devices as well as bring your own devices (BYODs), where employees use personal devices for work.
Email and other communication: Elaborate on content standards for communication by email and messaging services, as well as how to avoid hacks, malware, viruses, and inappropriate activity. Include examples of prohibited activity, such as sending spam, sharing internal-only information externally, and using discriminatory language.
Internet use and computer networks: Decide whether employees are permitted to use the network and the internet for any personal uses. If so, explain the types of personal uses that are allowed.
Generative AI: Identify which AI tools are approved for use and best practices for using them. Specify which types of data you will permit to be entered into AI and why. Include real-world examples from your business. Google Cloud provides guidelines about generative AI to include in an AUP.
Social media: Describe what information employees are permitted to share on social media and what they should avoid.
Software licenses and intellectual property: Make a clear statement banning the installation or use of unauthorized software and protecting copyright laws.
Handling confidential data: Elaborate on exactly what information is considered confidential and what information is not. Set strict practices for handling sensitive data and keeping it safe, including encrypting sensitive files. Specify which employees should and should not have access to confidential data.
Health and safety: This area refers to describing how employees can use technology safely and responsibly to protect everyone involved.
Cybersecurity: Explain the security protocols in place. Elaborate on the role of employees in maintaining security, such as changing passwords, avoiding public Wi-Fi, and using authentication protocols.
How To Create an Acceptable Use Policy
Human resources (HR), information technology (IT), and the legal departments can work together on creating your acceptable use policy. While you may refer to examples and templates, it is best practice to customize the content with specific information based on your organization, industry, and current protocols.
Establish a team to create and maintain the policy: Once you have management approval, select multi-disciplinary team members from HR, IT, and legal to create and maintain the policy.
Consult templates and examples: There are many helpful templates for creating a comprehensive AUP, including this Workable template that has step-by-step instructions and a template that is easy to customize.
Write your policy: Customize templates to define your purpose, scope, acceptable and unacceptable activities in each area, security procedures, employee monitoring, and consequences.
Review and edit the policy: Once your draft is done, several people need to review it, including human resources, management, and legal. Then, make edits for content and clarity, and seek final approval.
Communicate and train employees: In addition to including the policy in your employee handbook and on your intranet, employees need training and regular reminders about the policy. Think of onboarding as the first time they interact with the policy, not the last. Identify points of contact in HR and IT to answer employee questions about the policy.
Get acknowledgment: Have employees read and sign the policy as part of their onboarding process.
Review and update: Organizations need to regularly review and update their acceptable use policies to stay current with laws, business practices, and new technology. Before updating the policy, gather employee feedback on the current version to identify areas for improvement.
Best Practices To Help Employees Follow an Acceptable Use Policy
The most essential element of an AUP to help employees follow it is to use clear language that avoids technical and legal jargon. When language is simple, clear, and specific, employers can prevent confusion and misunderstandings. Employers can provide employee training on AUPs and even test employees on their understanding using survey tools.
Employers may use employee monitoring software to monitor usage, and some states require that employees be informed that it is being used. Regardless of notification requirements, it is best practice for employers to be transparent with employees about using employee monitoring software.
A well-written acceptable use policy that is regularly updated will help you continuously balance personal privacy with workplace monitoring. The clearly defined standards will protect both your business and your employees. When you provide detailed guidelines and resources that prevent employees from having to make judgment calls, you reduce the risk of mistakes and breaches.
Table of content
Share
