Acceptable Use Policy

An Acceptable Use Policy in the United States establishes the obligations and procedures governing the conduct it regulates.

The AUP is the primary instrument through which employers in the United States establish and enforce electronic workplace rules. Federal law provides the framework: the Electronic Communications Privacy Act (18 U.S.C. §§ 2510–2523) governs the interception and monitoring of electronic communications, but the statute's provider exception permits employers to monitor communications on systems they own and operate, provided employees have notice of monitoring. A signed AUP acknowledging consent to monitoring satisfies this notice requirement and negates employees' reasonable expectations of privacy on company-owned systems under the Fourth Amendment's private-employer analogue.

Across regulated industries, specific federal agencies and frameworks impose AUP-equivalent obligations that make this document effectively mandatory. The Health Insurance Portability and Accountability Act of 1996 (HIPAA), codified at 42 U.S.C. § 1320d, requires covered entities to implement policies restricting workforce access to electronic protected health information (ePHI), with the HIPAA Security Rule (45 C.F.R. Part 164) specifying that workforce use and access controls must be documented. The Payment Card Industry Data Security Standard (PCI DSS), administered by the PCI Security Standards Council, requires documented policies restricting access to cardholder data environments. Organizations subject to the Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6809) must implement safeguards programs that address employee access to nonpublic personal financial information.

At the state level, the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.) and state data breach notification statutes across all 50 states create additional incentives for documented IT governance. Delaware's Computer Security Breach Notification Law, New York's SHIELD Act (General Business Law § 899-aa), and Illinois' Personal Information Protection Act each impose obligations on businesses to maintain reasonable security procedures, which courts and regulators frequently interpret to require documented policies like AUPs.

An AUP differs from related documents in scope and function. A Privacy Policy governs how the organization handles personal data of customers and third parties, while an AUP governs internal employee conduct. A Terms of Service agreement governs external users' interaction with the organization's public-facing products. A Data Classification Policy addresses how data is categorized and handled by sensitivity level, while the AUP addresses the channels and systems through which employees access and transmit all categories of data. A BYOD Policy is a specialized subset of AUP principles applied specifically to employee-owned devices.

Organizations of all sizes in the United States benefit from a written AUP. For small businesses, an AUP creates the contractual basis for disciplinary action against employees who misuse IT resources — without it, terminating an at-will employee for internet misuse can still generate wrongful termination disputes. For enterprises and government contractors, AUPs are components of mandatory security programs under frameworks including NIST SP 800-53, CMMC (Cybersecurity Maturity Model Certification), and FedRAMP.

An Acceptable Use Policy is needed by every US organization that provides employees, contractors, volunteers, or any other users with access to company-owned or company-managed information technology resources. The document becomes specifically critical in a number of scenarios.

When onboarding new employees, the AUP establishes from the first day the rules governing use of company computers, email, and networks. Requiring signature at onboarding creates an employment record that the employee acknowledged the policy, which supports termination decisions and legal defenses if the employee later misuses IT resources.

When the organization deploys remote work or hybrid work arrangements, an AUP becomes essential because employees access company systems from home networks, personal routers, and personal devices. Without policy language specifically addressing remote access requirements — VPN use, home router security, prohibition on using public Wi-Fi without encryption — the organization loses control of corporate data outside the office perimeter.

When employees have access to sensitive data subject to regulatory protection — HIPAA-protected health information in a medical practice, payment card data in a retail business, student records under FERPA (20 U.S.C. § 1232g) in an educational institution, or classified export-controlled technical data subject to the Export Administration Regulations (15 C.F.R. Parts 730–774) — a documented AUP provides evidence of the organization's reasonable security procedures, a key factor in regulatory enforcement and civil litigation.

Following a data breach or security incident, a signed AUP enables the organization to demonstrate to the FTC, state attorneys general, and plaintiff's counsel that the organization had documented security policies and employee training, which can reduce liability and penalties under state breach notification statutes and FTC enforcement actions under Section 5 of the FTC Act (15 U.S.C. § 45).

When an employee is terminated for IT policy violations, the AUP provides the documentary basis for the termination and protects against claims of discriminatory or pretextual discharge. California, New York, Massachusetts, and other states with strong employee protections require employers to demonstrate that discipline was applied consistently with written policies.

Organizations contracting with federal agencies or defense contractors under the Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012 must implement security requirements from NIST SP 800-171, which includes system use notification (a functional equivalent of an AUP) as control 3.13.9.

A well-drafted Acceptable Use Policy for a United States organization should contain the following key provisions to be legally effective and practically enforceable.

The scope and applicability clause defines precisely which systems and users are covered. The policy should enumerate all covered resources — desktops, laptops, servers, mobile devices issued by the employer, cloud applications (Microsoft 365, Google Workspace, Salesforce), email systems, VPN connections, and any personal devices enrolled in the organization's mobile device management (MDM) system under a BYOD arrangement. The policy should apply to all employees, contractors, consultants, temporary workers, and any other persons with access to the covered systems.

The authorized use definition sets out what users may do on the systems. Many organizations permit limited incidental personal use of internet access during non-work periods. Any such permission must be expressly stated, because if personal use is permitted, users may argue a greater expectation of privacy in their personal activities. The authorized use section should also identify specific business applications and data systems users are permitted to access, reflecting the principle of least-privilege access required by NIST SP 800-53 control AC-6.

The prohibited conduct section is the policy's operational core. Prohibited activities should specifically include: accessing or attempting to access computer systems, accounts, or data without authorization, which triggers liability under the Computer Fraud and Abuse Act (18 U.S.C. § 1030); installing unlicensed software, which creates copyright liability under the Copyright Act (17 U.S.C. § 101 et seq.) for the organization; accessing, downloading, or distributing obscene, harassing, or discriminatory content, which can create hostile work environment liability under Title VII of the Civil Rights Act (42 U.S.C. § 2000e); transmitting confidential information to unauthorized external recipients; circumventing security controls, firewalls, or content filters; and using organizational systems for personal commercial activity, cryptocurrency mining, or any illegal purpose.

The monitoring and privacy notice is legally required for the policy to be effective. The notice must state that the organization reserves the right to monitor, record, inspect, and disclose any communications or activity on its systems, that users have no expectation of privacy on company-owned equipment or networks, and the specific types of monitoring the organization conducts (email scanning, web activity logging, keystroke logging, screen capture). Under the Electronic Communications Privacy Act (18 U.S.C. § 2511(2)(a)(i)), consent to monitoring can be established through policy acknowledgment. Several states — Connecticut (Conn. Gen. Stat. § 31-48d), New York (N.Y. Lab. Law § 740), and Delaware (Del. Code tit. 19 § 705) — impose specific electronic monitoring notice requirements beyond the federal baseline.

The data handling and classification provisions should address how employees must treat confidential company information, customer data, and regulated data categories. Requirements should include: using only approved cloud storage and file-sharing services; encrypting data in transit when transmitting sensitive information; not storing regulated data (HIPAA ePHI, PCI cardholder data) on personal devices; and following the organization's document retention and destruction schedules.

The social media and public communications clause addresses what employees may and may not post publicly about the organization. The policy should prohibit disclosing confidential business information, trade secrets, and non-public financial information on social media, while acknowledging employees' rights under Section 7 of the National Labor Relations Act (29 U.S.C. § 157) to engage in protected concerted activity about working conditions.

The disciplinary consequences section must specify the range of disciplinary actions available — verbal warning, written warning, suspension of system access, termination of employment, and criminal referral — and clarify that violations may result in any of these outcomes depending on severity. The section should state that the organization will investigate suspected violations and that findings may be reported to law enforcement.

The forms-legal.com Acceptable Use Policy template covers all eight mandatory sections — scope, authorized use, prohibited conduct, monitoring notice, data handling, social media, disciplinary consequences, and acknowledgment — aligned with NIST SP 800-53 control PL-4 and CFAA compliance requirements.

The acknowledgment and signature block requires each user to sign and date the policy, confirming they have received, read, and understood it. Electronic acknowledgments (e-signature or checkbox acknowledgment through an HR system) are legally equivalent to handwritten signatures under the Electronic Signatures in Global and National Commerce Act (E-Sign Act, 15 U.S.C. § 7001) and the Uniform Electronic Transactions Act (UETA), enacted in 49 states.