Naresh Thalla Mudhiraj
⌕ Search Ctrl K 🔥 0Lv 1
All templates

Policy template

Acceptable Use Policy

What people may and may not do with company devices, accounts and data, written so everyone can follow it.

Inside the document

  1. General principles
  2. Devices
  3. Accounts and credentials
  4. Email, messaging and web
  5. Software and cloud services
  6. Handling information
  7. Working remotely and travelling
  8. Generative AI and automated tools
  9. Social media and public statements
  10. Monitoring
  11. Reporting

Plus document control, roles, exceptions, enforcement, review cycle and an auditor evidence checklist.

Sample clause · Generative AI and automated toolsCheck AI-generated content for accuracy, bias and copyright before relying on it or sharing it, and take responsibility for what you submit.

What an auditor will check

It is written for users, every worker has acknowledged it, and the rules are backed by technical controls such as device encryption and web filtering.

Reference mapping: ISO/IEC 27001:2022 Annex A 5.10, 6.3, 6.4, 8.1 · SOC 2 (2017 criteria) CC1.1, CC1.4, CC2.2 · NIST CSF 2.0 GV.PO-01, PR.AT-01. Starting point to be adapted by the organisation to its own context. Not legal advice.

Download (.docx, 42 KB)

Free. Enter your email once to unlock all downloads.

Next upPractise the controls in a hands-on lab