# Acceptable Use Policy (AUP)

> ISO/IEC 27001:2022 A.5.10 – rules for acceptable use of information
> and assets. Every employee/contractor signs acknowledgment.

| Field | Value |
|-------|-------|
| Document ID | POL-AUP-001 |
| Applies to | All staff + contractors |
| Approved by | Management |
| Effective | YYYY-MM-DD |

## 1. Purpose

Define acceptable and prohibited use of organizational information
assets (devices, networks, data, services) to protect CIA.

## 2. General rules

- Use assets for authorized business purposes only
- Follow classification handling rules for all data accessed
- No sharing credentials; MFA mandatory
- Report suspected incidents immediately (per DOC-ISMS-020)

## 3. Acceptable use

| Category | Allowed | Conditions |
|----------|---------|------------|
| Work devices | business tasks + limited personal use | no policy violations |
| Email | business communication | no sensitive data unencrypted |
| Internet | work + reasonable personal browsing | no prohibited content |
| Software | approved list only | IT installs; no self-installed |
| Cloud services | sanctioned SaaS only | data classification rules apply |
| Remote work | VPN + encrypted device | no public Wi-Fi without VPN |

## 4. Prohibited activities

- Unauthorized access to systems/data (even within own permissions)
- Copying Restricted data to personal devices/accounts
- Disabling security controls (MDM, AV, encryption)
- Using unapproved software/services for work data
- Bypassing monitoring or logging
- Sharing Restricted/Confidential data externally without approval

## 5. Monitoring notice

Organization may monitor usage for security and compliance –
disclosed as required by applicable law.

## 6. Violations

Consequences: warning through termination; may include legal action.

## 7. Acknowledgment

I have read and agree to this policy.

Signed: ______________ Date: ________ Name: ______________