Acceptable use policy for a small business: what to include (and what to leave out)
An acceptable use policy (AUP) tells employees what they may and may not do with company computers, accounts, networks and data. It's usually the first policy a small business adopts, and the one every employee signs. A good one is short enough to read, specific enough to act on, and fair about personal use and monitoring.
This is general guidance, not legal advice. Employment and privacy rules (especially on monitoring) vary by state and country, so have a qualified advisor review your final policy.
Why bother with an AUP?
- Clear expectations: people can't follow rules nobody wrote down.
- A basis for action: if someone misuses systems, a signed policy makes the conversation simpler.
- Insurance and customers: cyber-insurance applications and customer security questionnaires often ask whether staff acknowledge security policies.
What to include
1. Scope
Say who it covers (employees, contractors, temps, interns) and what it covers: company devices, personal devices used for work, company accounts and cloud services, networks and data wherever they're stored.
2. General principles
Use systems for business purposes, protect company information, follow the other security policies, and report anything suspicious promptly.
3. Prohibited activities
Be concrete: no illegal activity, harassment or offensive content; no installing unapproved software or disabling security tools; no sharing accounts or credentials; no moving company data to personal email or storage; no connecting unknown USB devices; no attempts to access data you aren't authorized to see.
4. Email, messaging and internet
Treat links and attachments with care, verify unusual requests by phone (especially anything involving money or bank details), and keep business communication on company channels.
5. Generative AI tools
This is the section older policies are missing. Staff are already pasting text into AI chatbots. Decide and write down: which AI tools are approved; that confidential, customer or personal data must not be entered into unapproved tools; that people remain responsible for checking AI output for accuracy; and that AI-generated content must follow the same rules as anything else they produce.
6. Company equipment
Keep devices locked when unattended, don't let family use work laptops, report loss or theft immediately, and return everything when leaving.
7. Reasonable personal use
Most small businesses allow limited personal use that doesn't interfere with work or create risk. Saying so explicitly is better than an unrealistic total ban nobody follows.
8. Monitoring and privacy
If you monitor company systems (email filtering, web filtering, security logs, device management), tell people, in plain language, what is monitored and why. Transparency is fairer, and in some places notice is legally required; check local rules.
9. Violations and acknowledgment
State that violations may lead to disciplinary action, and require a signed acknowledgment at hire and after significant updates.
What to leave out
- Technical configuration detail: put password lengths, backup schedules and the like in their own policies so the AUP stays readable.
- Legalese nobody reads: plain English gets more compliance.
- Rules you won't enforce: an ignored rule teaches people the whole policy is optional.
Rolling it out
- Fill in your company details and decisions (approved tools, personal use, monitoring).
- Have leadership approve it.
- Walk staff through the key points in 10 minutes, then collect signatures.
- Add it to onboarding and review it yearly.
Start from a template
Our Acceptable Use Policy template covers all of the above, including a generative AI section and a monitoring and privacy section, as an editable Word document with [BRACKETED] fields, guidance notes and an acknowledgment page. It is also included in the Starter Kit and the Complete Bundle.