IT Acceptable Use Policy
- Document ID
- PDC-AUP-SAMPLE
- Document version
- 1.0
- Template version
- v1.0.0
- Effective date
- September 27, 2026
- Next review
- September 27, 2027
1. Purpose
This policy sets the rules every [Company Name] employee must follow when using company computers, phones, networks, accounts, software, email, internet access and data (together, "company technology"). It also tells you what the company monitors and why.
Most security incidents start with an ordinary action: clicking a convincing link, installing a free program, plugging in a USB drive, or sending a file to a personal account. These rules exist to protect the company, its customers and you from those mistakes, and to keep company systems available for the work they are meant to do.
Following this policy supports the company in meeting its legal, contract and customer obligations. Where a law, regulation or contract sets a stricter requirement, the stricter requirement applies. If you are not sure whether something is allowed, stop and ask the IT Manager before you act.
2. Scope
Who it covers. This policy applies to all employees of [Company Name], and to temporary workers, interns, contractors and anyone else who uses company technology or handles company or customer information ("users").
What it covers. It covers all company technology, wherever and whenever it is used, including at home and while traveling. It also covers any personal device or account used to access company email, files or systems, but only for the company information and company apps on it.
Artificial intelligence. Use of AI tools, including AI features built into software you already use, is governed by the separate AI Acceptable Use Policy where the company has adopted one. Until then, you must not enter confidential, customer or personal information into any AI tool the company has not approved.
Other policies. This policy works alongside the company's information security, password, remote work and device, incident response and HR policies, where adopted. When two rules conflict, follow the stricter rule.
Your rights. Nothing in this policy prohibits or restricts you from discussing or sharing information about your wages, hours or other terms and conditions of employment, including on social media, from acting together with coworkers to improve working conditions, from filing a charge or complaint with, or taking part in an investigation by, any government agency, or from reporting a possible violation of law. This policy will not be interpreted or applied to interfere with those rights.
3. Key Terms
- Company technology
- Computers, phones, tablets, printers, networks, Wi-Fi, accounts, email, software, cloud services and data that the company owns, leases, licenses or manages.
- Company device
- Any computer, phone, tablet or other device the company provides to you or manages.
- Personal device
- A phone, tablet or computer that you own, even if you use it for work.
- Company account
- Any login the company creates or pays for, such as your email, file storage, business applications and customer or supplier portals used for company work.
- Confidential information
- Nonpublic business information of the company or its customers and suppliers, such as customer lists, pricing, bids, drawings, financial results, security settings and personal information about customers. It does not include information about your own wages, hours or working conditions.
- Removable media
- USB drives, external hard drives, memory cards, and phones or cameras connected to a computer as storage.
- Phishing
- A fake email, text, call or message designed to trick you into clicking a link, opening a file, sharing a password or sending money.
- Monitoring
- Automated or manual review of how company technology is used, as described in the Monitoring and Privacy section.
4. General Responsibilities
Company property. Company technology, and everything created, sent, received or stored on it, belongs to the company. It is provided so you can do your job.
Your login is yours alone. You are responsible for activity under your accounts. You must:
- Follow the company's password rules, and never share your password or one-time codes with anyone, including coworkers, managers or someone who says they are from IT
- Use multi-factor authentication wherever the company provides it, and never approve a sign-in prompt you did not start
- Never use another person's account, or let anyone use yours
- Use your company account for company work, and never use a personal email or personal cloud account for company business
Approved technology. The IT Manager maintains the list of approved hardware, software and cloud services and will share it on request. Only technology on that list, set up by or approved in writing by the company, may be used for company work or connected to the company network.
Security tools. Never disable, bypass, uninstall or interfere with antivirus, device management, encryption, web filtering, backup or other security tools, and never try to get around access restrictions, even to get your work done faster. Ask IT for help instead.
5. Company Devices and Personal Devices
Caring for company devices. You must:
- Lock your screen whenever you step away. Screens also lock automatically after 15 minutes of inactivity, and you must not change that setting.
- Restart when prompted so security updates install, and never postpone updates for more than a day without IT approval
- Keep devices with you or locked away when traveling, never leave them visible in a vehicle, and never check them as luggage
- Use only company Wi-Fi, a trusted home network or a mobile hotspot for company work, and avoid public Wi-Fi for sensitive tasks
- Not let family members, friends or anyone else use a company device
- Not take company devices out of the country without approval from IT
Lost or stolen devices. Report a lost or stolen company device, or a personal device with company apps on it, to the IT Manager right away, and no later than 1 hour after you notice. Early reports let the company lock or wipe the device before anyone can use it.
Personal devices. You may use a personal phone or tablet for company email, chat and files only through the company-managed apps IT sets up, and only if the device:
- Has a screen lock with a PIN, password or biometric
- Runs an operating system version that still receives security updates
- Is not jailbroken or rooted
Company management applies only to the company apps and data on your device. The company can remove company data from those apps, for example when a device is lost or you leave, but it does not see or remove your personal photos, messages or apps.
Shared computers. Sign out of shared computers, such as front desk, conference room or break room computers, after every use, and never save company files on them.
Leaving the company. On or before your last day, you must return all company devices, drives, badges and equipment, and must not keep, copy or forward company information. Company accounts are disabled when you leave.
6. Software and Cloud Services
Installing software. Only IT may install software on company devices, and employees do not have administrator rights. This includes free programs, trial versions, browser extensions, plug-ins and utilities. Request anything you need through IT.
Licensing. Use software only as its license allows. Do not copy company software to personal devices, share license keys, or install pirated, cracked or unlicensed software on any device used for company work.
Cloud services and apps. Do not sign up for, or use, any online service, app or website account for company work unless the company has approved it, even if it is free. This includes file sharing, note-taking, scheduling, e-signature, design, project management and messaging services. Request new services through the IT Manager, and include what you need it for and what information it would hold.
Downloads. Download files and apps only from trusted sources. Never run a program, script or macro that arrived unexpectedly by email, text or chat, or that a website or pop-up tells you to run. If a pop-up says your computer is infected or tells you to call a phone number, close it and call IT.
7. Email, Messaging and Phishing
Professional use. Write every email and message as if it could be read by a customer, a court or a news reporter, because it might be. Company email and messaging must not be used to send harassing, threatening, discriminatory, obscene or illegal content, chain letters or mass personal messages.
Forwarding and personal email. Do not forward company email to a personal email account, set up automatic forwarding outside the company, or send company files to yourself at a personal address. Do not use a personal email account for company business.
Business texting. You may use text messages for quick coordination, such as arrival times, meeting places or a reminder to check email. Decisions, orders, change requests, approvals, pricing and customer commitments must be made or confirmed in company email or company systems, so there is a company record of them. Never send confidential or personal information by text message.
Phishing. Be suspicious of any message that is unexpected, urgent, or asks you to click a link, open an attachment, sign in, share information or send money, even if it appears to come from a coworker, customer or supplier you know. Use the report phishing button where one is provided, or forward the message to IT, then delete it. If you clicked a link, opened a file or entered your password, report it immediately.
Payment and banking changes. Before you change anyone's bank or payment details, send a wire or payment because of an email, or buy gift cards because someone asked, confirm the request by calling the person at a phone number from company records, not one given in the message. Do this every time, even when the request looks like it comes from an executive. Business email compromise is one of the costliest crimes reported to the FBI.
8. Internet Use and Personal Use
Internet use. Internet access on company devices and networks is provided for company business. You must not visit, download or stream content that is sexually explicit, hateful, violent, related to illegal activity or gambling, or that could create a hostile work environment. Do not use file-sharing, torrent, proxy or VPN services the company has not approved.
Web filtering. The company filters web access and blocks websites that are known to be malicious or that fall into risky categories. If a site you need for work is blocked, ask IT to review it. Do not try to get around the filter.
Limited personal use. Brief, occasional personal use of company devices and internet access is allowed, such as checking the news, a personal appointment or a family message on a break, as long as it:
- Does not interfere with your work, your coworkers or company systems
- Happens on your own time, such as breaks and lunch, except for brief necessary messages
- Does not involve a personal business, outside job, political campaign or fundraising
- Does not involve downloading or installing software, streaming large amounts of video, or storing personal files on company systems
- Follows every other rule in this policy
Personal use is never allowed on production, shop floor, payment or other systems the company designates as business-only.
Personal devices on company networks. Connect personal phones and devices only to the guest Wi-Fi network, never to the company network or to company computers, unless IT has approved it.
9. Storing, Sharing and Protecting Information
Where information lives. Store and share company information only in company systems, such as company email, file storage and business applications. You may also use a portal or file-sharing service that a customer or supplier provides and requires for their own work, using the company account they set up for you, and only for that work.
Personal accounts and storage. Never store or send company information using personal cloud storage, personal email, personal messaging apps or personal devices, other than through the company-managed apps described in this policy.
Share only what is needed. Share information only with people who need it for their work, use the most limited sharing setting that works, and remove access when a project ends. Do not create "anyone with the link" shares for confidential information.
Removable media. Use only encrypted, company-issued USB drives and external drives for company information, and only when company file sharing will not work. Never plug in a drive you found, received at an event or were sent unexpectedly. Hand it to IT instead. Report a lost drive right away.
Paper and printing. Collect printouts right away, lock up confidential papers, and shred them when they are no longer needed.
Personal information. Personal information, such as Social Security numbers, driver's license numbers, bank account numbers, dates of birth and medical details about employees or customers, must be stored only in approved company systems and sent only by approved secure methods, such as encrypted email or company file sharing. It must never be kept in personal accounts, on personal devices or on unencrypted removable media. State laws, including those of North Carolina, can require the company to notify people when their personal information is exposed, so report any possible exposure right away.
11. Prohibited Activities
You must never use company technology, or any technology used for company work, to:
- Break the law, or help anyone else break it
- Harass, threaten, bully or discriminate against anyone, or view, send or store sexually explicit, hateful or violent material
- Access, copy, change or delete information or systems you are not authorized to use, or try to learn other people's passwords
- Scan, test or probe networks or systems, or install hacking, password-cracking, packet capture or remote access tools, unless it is part of your approved job
- Connect unapproved routers, wireless access points, switches, cameras or other devices to the company network
- Mine cryptocurrency, run personal servers or share company internet access
- Send spam, chain letters or unauthorized mass email
- Download, copy or share pirated software, music, movies or other material you do not have the right to use
- Impersonate another person, or send messages that hide or fake who sent them
- Take, copy or send company or customer information for any purpose outside your job, including before leaving the company
12. Monitoring and Privacy
Notice of monitoring. [Company Name] monitors the use of company technology to protect its systems and information, to meet legal and customer requirements, to investigate problems, and to support its operations. This policy is your written notice of that monitoring. Depending on the system, the company monitors:
- Email, chat and messages sent or received through company accounts, including attachments
- Websites visited and internet activity on company devices and networks, including web filtering logs
- Security, software and activity logs on company devices, including the software installed and security alerts
- Sign-ins, file activity and sharing in company cloud services such as email, file storage and business applications
No expectation of privacy on company systems. Company technology belongs to the company. You should not expect privacy in anything you create, send, receive, browse or store on company devices, accounts or networks, including personal messages and files. Deleting something does not mean it is gone, because systems keep logs and backups. The company may access, review, copy, preserve and disclose that information when it has a legitimate business reason, as the law allows.
Limits the company follows. Monitoring information is restricted to the people who need it for security, IT support, legal or HR purposes. The company will not:
- Ask for the password to your personal email, social media or other personal accounts
- Monitor your personal device beyond the company apps and data on it
- Use monitoring to watch, record or interfere with employees discussing wages or working conditions, or with lawful activity protected by law
Reviewing an individual. A targeted review of a specific person's email, files or activity, other than automated security alerts, requires approval from the Chief Executive Officer or a person the Chief Executive Officer designates, and a record of why it was done.
State notice requirements. Some states, including New York, Connecticut and Delaware, require a specific written notice, acknowledgment or posting before an employer monitors email, phone or internet use. Where those laws apply, the company provides that notice, and your signed acknowledgment of this policy is part of it.
13. Training and Reporting
Security awareness training. You must complete security awareness training when you join the company and at least once a year after that. The company may also send simulated phishing messages to help you practice. Clicking one is a chance to learn, not a disciplinary matter by itself.
What to report. Report right away, and no later than 1 hour after you notice, if:
- A company device, or a personal device with company apps, is lost or stolen
- You clicked a suspicious link, opened a suspicious file, or entered your password on a site you now doubt
- You see a sign-in or multi-factor prompt you did not start, or think someone else knows your password
- Company or customer information was sent to the wrong person, posted, lost or shared in a way this policy does not allow
- A device behaves strangely, such as unexpected pop-ups, files you cannot open, or security warnings
- You see someone using company technology in a way that breaks this policy
How to report. Contact the IT Manager. If you think a device is infected, disconnect it from the network but leave it powered on, and do not try to fix it yourself. Do not delete emails, files or messages involved unless you are told to.
No retaliation. You will not be disciplined for reporting a mistake or concern in good faith, and a prompt, honest report counts in your favor. Hiding a problem, or delaying a report on purpose, is a violation of this policy. The company does not allow retaliation against anyone who reports in good faith.
14. Enforcement, Exceptions and Review
Consequences. Violating this policy may lead to loss of access to company technology and to discipline, up to and including termination of employment or of a contract, consistent with company policy and applicable law. The company may report illegal activity to law enforcement and may seek to recover losses caused by intentional misconduct.
Exceptions. Any exception to this policy must be requested in writing from the IT Manager, explaining the business need and how the risk will be limited. Exceptions are approved by the IT Manager, recorded, limited in time, and reviewed at least once a year. No exception can allow something that breaks the law or a contract.
Review. The IT Manager is responsible for this policy and will review it no later than September 27, 2027, and sooner after a significant security incident, a new law or contract requirement, or a major change in company technology. The company will tell you when the rules change.
16. Employee Acknowledgment
Whistleblower immunity notice. Under the Defend Trade Secrets Act, 18 U.S.C. 1833(b), you will not be held criminally or civilly liable under any federal or state trade secret law for disclosing a trade secret in confidence to a federal, state or local government official, directly or indirectly, or to an attorney, solely for the purpose of reporting or investigating a suspected violation of law, or in a complaint or other document filed under seal in a lawsuit or other proceeding.
I have received and read the [Company Name] IT Acceptable Use Policy, effective September 27, 2026. I understand it, I have had the chance to ask questions, and I agree to follow it. I understand that the company monitors company technology as described in the Monitoring and Privacy section, and that I should not expect privacy in anything I create, send, receive or store on company systems. I understand that violations may lead to discipline, up to and including termination, that the company may update this policy, and that this acknowledgment is not a contract of employment.
Employee name (printed)
Job title
Employee signature
Date
17. Document Control and Revision History
| Field | Value |
|---|---|
| Document | IT Acceptable Use Policy |
| Organization | [Company Name] |
| Document ID | PDC-AUP-SAMPLE |
| Document version | 1.0 |
| Effective date | September 27, 2026 |
| Next scheduled review | September 27, 2027 |
| Policy owner | IT Manager |
| Approved by | Chief Executive Officer |
| Source template | Preferred Data Corporation IT Acceptable Use Policy template v1.0.0 |
Revision history. Record every change to this policy below. Increase the document version and obtain approval again each time the policy is revised.
| Version | Date | Description of change | Approved by |
|---|---|---|---|
| 1.0 | September 27, 2026 | Initial adoption, generated from template v1.0.0. | Chief Executive Officer |
| Blank | Blank | Blank | Blank |
| Blank | Blank | Blank | Blank |
18. Template Notice and Legal Disclaimer
This document was generated from a starter template provided by Preferred Data Corporation. It is general information only. It is not legal advice and it is not a substitute for advice from a licensed attorney.
Preferred Data Corporation is not a law firm. It makes no representation that this document is complete, current, or suitable for any particular organization, industry, jurisdiction, or regulatory requirement, and it is not responsible or liable for any use of this template or of any policy created from it. You are solely responsible for how you adapt, adopt, and enforce it.
Laws, regulations, insurance requirements, and contracts that apply to your organization may require different or additional terms. Before you adopt, publish, or rely on this policy, and in every case where you have a legal, regulatory, or contractual obligation, have it reviewed by qualified legal counsel.