An acceptable use policy your staff will actually read

The short answer

An IT acceptable use policy (AUP) is a short document that tells employees how they may use company computers, accounts, email, internet, data and software, what is not allowed, and what happens if rules are broken. A good small business AUP fits on three to five pages and covers: scope, account and password rules, devices, email and internet, data handling, software and AI tools, remote work, personal devices, monitoring, reporting incidents, consequences and a signature block.

Below is a section outline you can adapt, with sample wording, followed by how to roll it out so people sign it and follow it. This is general information, not legal advice. Employment and privacy rules vary by state, so have counsel review your final version, especially the monitoring section.

Why a small business needs one

• It sets expectations. Staff cannot follow rules nobody wrote down.
• It supports security controls. Multi-factor authentication, device rules and data handling only work when people know they are required.
• Insurers and clients ask. Cyber-insurance applications and client security questionnaires often ask whether you have written security policies and whether employees acknowledge them.
• It helps when something goes wrong. A signed policy makes it clearer what was allowed when you investigate an incident or address misconduct.

The NIST Cybersecurity Framework 2.0 includes policy as part of its Govern function, and the SANS Institute publishes free policy templates, including an acceptable use standard and an artificial intelligence standard, that you can use as a starting point.

Acceptable use policy template: section outline

Use these twelve sections. Keep each one short and specific to your business.

1. Purpose and scope. Who the policy covers (employees, contractors, interns) and what it covers (company devices, accounts, networks, data and any personal device used for work). Sample: “This policy applies to everyone who uses systems or data, on any device, in any location.”
2. Accounts and passwords. One account per person, no sharing, a password manager, and multi-factor authentication wherever offered. Sample: “Never share your login or approve a sign-in request you did not start.”
3. Company devices. Devices are company property, must stay updated and encrypted, must lock when unattended, and may not have security tools disabled. Report loss or theft immediately.
4. Email and messaging. Use company email for company business. Verify payment or banking changes by phone using a known number. Do not auto-forward company mail to personal accounts.
5. Internet use. Reasonable personal use is allowed if it does not interfere with work or create risk. List clearly prohibited activity: illegal content, harassment, piracy, gambling on company devices.
6. Data handling. Define what counts as confidential (client records, financials, personnel files). Store it only in approved systems. Do not copy it to personal drives or USB sticks.
7. Software and cloud apps. Install or sign up for work software only with approval. Keep a short approved list.
8. AI tools. Which AI tools are approved, what data may never be entered, and that people remain responsible for checking AI output. More on this below.
9. Remote work and public Wi-Fi. Use approved remote access, keep screens private, and do not leave devices in cars.
10. Personal devices. Whether phones and home computers may access company email or files, and the minimum requirements (screen lock, updates, the company’s management app).
11. Monitoring and privacy. State that company systems may be monitored and logged for security and business purposes, and that there is no expectation of privacy on them. Have counsel review this section.
12. Reporting and consequences. How to report a suspicious email, a lost device or a mistake, a promise that honest reports will not be punished, and that violations may lead to discipline.

Finish with an acknowledgment: “I have read and understand this policy and agree to follow it,” with name, signature and date.

Writing an AI acceptable use section

AI tools are a gap in many older policies. People paste client data into free chatbots without thinking. Add a short section that covers:

• Approved tools, ideally business versions where your data is not used to train models
• Data that must never be entered: client personal information, health or financial records, passwords, unreleased financials, anything under a confidentiality agreement
• That employees review and take responsibility for anything AI produces before it goes to a client
• No AI note-takers in meetings without telling participants
• Who to ask before trying a new AI tool

For ideas on where AI genuinely helps, see our guide to practical AI uses for small business owners.

Want to know where your policies and controls stand? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, business continuity and more as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

How to get staff to sign and follow it

1. Keep it short. Five pages that people read beat twenty pages they skip. Move technical detail to separate IT procedures.
2. Write in plain English. Use “you must” and “do not”, with examples.
3. Walk through it. Spend 15 minutes at a staff meeting on the five rules that matter most: MFA, verifying payment changes, reporting phishing, approved apps and AI data rules.
4. Collect signatures electronically. An e-signature tool or a form in your HR system creates a dated record for each person.
5. Make it part of onboarding. New hires sign before they get accounts. Pair it with a structured process like our offboarding checklist for when people leave.
6. Back it with technical controls. Enforce MFA, block risky sites, and manage devices so the policy is not the only safeguard.
7. Review yearly. Update it when you adopt new tools, then ask everyone to re-acknowledge.

Common mistakes

• Copying a large-company template full of rules nobody can follow
• Banning all personal use, then ignoring it, which teaches staff the policy is not serious
• Leaving out contractors and temporary staff
• Never updating it, so it still talks about USB drives but not AI or cloud apps
• No record of who signed which version
• Rules that IT does not actually enforce, such as “use MFA” when MFA is not turned on

Pair the policy with a few procedures

A policy says what people must do. Short procedures say how. Keep these as one-page documents your team can find quickly:

• Reporting a suspicious email: which button to press or who to forward it to.
• Lost or stolen device: who to call, and what IT does next, such as remote wipe and password resets.
• Requesting new software or an AI tool: who approves it and how long it takes.
• Verifying a payment change: call the vendor on a known number before any bank detail is updated.
• Joining and leaving: what accounts are created on day one and removed on the last day.

How JLB USA helps

JLB USA’s cybersecurity services put the technical side behind your policy: multi-factor authentication, access reviews, same-day removal of leavers, endpoint protection, updates, encryption and email security. We also help with cyber-insurance questionnaires that ask about written policies. We do not give legal advice, so we recommend counsel review your final policy.

Keep reading

• Cybersecurity for accounting firms: FTC, IRS and tax-season essentials
• Cybersecurity for small manufacturers: ransomware, OT and supplier demands
• How to choose the best firewall for a small business
• Cyber insurance requirements in 2026: what insurers commonly ask for

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Employee offboarding IT checklist
• Managed IT services