What an acceptable use policy covers

What it usually covers

• Company devices. Who may use them, personal use, and installing software.
• Accounts and passwords. No sharing logins, using a password manager, and multi-factor authentication.
• Email and messaging. Business use, personal use and what not to send.
• Data. Where company files may be stored, and not using personal cloud accounts or USB drives for work data.
• Personal devices. Whether staff may use their own phones or computers for work, and what that requires.
• Internet use. Sites and activities that are not allowed on company systems.
• AI tools. Which ones are approved and what information may not be entered into them.
• Remote work. Working from home and public places.
• Reporting. How to report a lost device, a suspicious email or a mistake, without fear of blame.
• Leaving the company. Returning devices and handing over accounts.
• Monitoring. What the company may monitor on its own systems.

Make it work

• Keep it short and readable. A few pages people actually read beats a long document nobody opens.
• Explain the why. Rules with reasons are easier to follow.
• Have staff acknowledge it, at hiring and when it changes.
• Review it every year, and when new tools arrive.
• Have it checked by whoever advises you on employment matters.