All templates
Policy template
Acceptable Use Policy
What people may and may not do with company devices, accounts and data, written so everyone can follow it.
Inside the document
- General principles
- Devices
- Accounts and credentials
- Email, messaging and web
- Software and cloud services
- Handling information
- Working remotely and travelling
- Generative AI and automated tools
- Social media and public statements
- Monitoring
- Reporting
Plus document control, roles, exceptions, enforcement, review cycle and an auditor evidence checklist.
Sample clause · Generative AI and automated toolsCheck AI-generated content for accuracy, bias and copyright before relying on it or sharing it, and take responsibility for what you submit.
What an auditor will check
It is written for users, every worker has acknowledged it, and the rules are backed by technical controls such as device encryption and web filtering.
Reference mapping: ISO/IEC 27001:2022 Annex A 5.10, 6.3, 6.4, 8.1 · SOC 2 (2017 criteria) CC1.1, CC1.4, CC2.2 · NIST CSF 2.0 GV.PO-01, PR.AT-01. Starting point to be adapted by the organisation to its own context. Not legal advice.
Download (.docx, 42 KB)
Free. Enter your email once to unlock all downloads.