An acceptable use policy, often shortened to AUP, is a short document every employee signs that sets the rules for using company technology. It covers computers and phones, email, internet access, software, accounts, and the data those systems hold. Done well, it turns security expectations into plain instructions and gives the business a fair, consistent standard when a rule gets broken. For businesses that take card payments or handle patient records, it is also a compliance requirement.
Plenty of small businesses have no policy at all, or one copied from a university website years ago that nobody has opened since onboarding. This guide covers what a working acceptable use policy includes, what PCI DSS and HIPAA expect from it, how monitoring language should handle California rules, and how to roll it out so people actually follow it.
What an acceptable use policy does for a small business
Many security incidents in small offices start with ordinary behavior. A shared password, a work file saved to a personal Dropbox, an unvetted browser extension, or an app a team adopted without asking can all open the door. That last habit has a name, shadow IT, and it is common. An AUP names those behaviors in advance and tells people what to do instead. It also protects the business when discipline is needed, because the rule was written down, explained, and signed beforehand.
What a policy cannot do is enforce itself. It works alongside technical controls such as multifactor authentication, device management, and email filtering. The best policies describe rules the systems already back up, because a policy that forbids something the systems still allow depends entirely on memory.
The AUP is the employee facing layer of a larger set of documents. Your information security policy sets the company's commitments and assigns responsibility. Separate policies cover data retention, personal devices, AI tools, and incident response. The AUP should summarize the daily rules and point to those documents for detail rather than repeat them.
When the policy is a compliance requirement
Many businesses treat the AUP as optional paperwork until an assessor or auditor asks to see it. For payment card and healthcare businesses, the requirement is already written into the rules they follow.
PCI DSS for businesses that take cards
PCI DSS version 4.0.1, available from the PCI Security Standards Council, addresses acceptable use directly in Requirement 12.2.1. Acceptable use policies for end user technologies must be documented and implemented, explicitly approved by authorized parties, and must define acceptable uses and list the hardware and software the company approves. The standard's guidance gives remote access, wireless, laptops, tablets, phones, removable media, email, and internet use as examples.
Requirement 12.6.3 adds the people side. Staff must receive security awareness training at hire and at least once every 12 months, that training must cover acceptable use, and personnel must acknowledge at least once every 12 months that they have read and understood the security policy. That is why a signed, dated policy is standard evidence in PCI DSS compliance work.
HIPAA for medical and dental practices
The HIPAA Security Rule requires workstation use policies that specify how computers with access to electronic patient information are used and where they sit. It also requires a sanction policy for workforce members who do not follow security policies. An AUP is the natural home for both. HIPAA also requires that policy documentation be kept for six years, so store every version and every signed acknowledgment with your HIPAA compliance records.
Financial firms and everyone else
The FTC Safeguards Rule covers financial businesses such as tax preparers and mortgage brokers, and it requires them to train staff so they can carry out the information security program. An AUP is where those expectations become concrete. Businesses outside these rules still meet the question in client security questionnaires, vendor contracts, and cyber insurance applications, which often ask whether written policies exist.
What a working policy covers, section by section
A good policy is organized around what employees touch in a normal day, not around technology categories. Each section below forces a decision, and making those decisions is most of the work.
Who it covers, what you own, and what you monitor
Start with the people covered: employees, contractors, interns, and temporary staff. Then define what is covered: company devices, accounts, networks, and any personal device used for work. State that company systems and their data belong to the business. Say plainly what you monitor and why, such as email filtering, web filtering, sign in records, or device management. A vague line about monitoring anything at any time reads as a threat and builds no trust.
Monitoring language has legal edges worth reviewing with employment counsel. If your business meets the CCPA's thresholds, the law has applied to employee personal information since January 1, 2023, including a notice at collection, as explained on the California Attorney General's CCPA page. California's Penal Code also requires the consent of all parties before a confidential call is recorded. If you have staff in New York, the state requires employers to give written notice of electronic monitoring and collect acknowledgments.
One update matters for 2027. California's new rules on automated decision making technology apply to tools that replace or substantially replace human judgment in significant decisions, a category that includes hiring, pay, work assignments, promotion, and termination. Employers using such tools must comply by January 1, 2027, including a notice before use. If any monitoring or productivity software you use feeds decisions like those, your policy and your notices need to say so.
Accounts, passwords, and signing in
Every person gets their own account, and accounts are never shared, including that front desk login everyone knows. Require a company password manager for work credentials and multifactor authentication on every system that supports it. Tell people never to approve a sign in prompt they did not start. Keep administrator accounts separate from everyday accounts and use them only for administrative work.
Email, internet, and messaging
Define business use and a realistic amount of personal use, because a rule nobody can follow becomes a rule nobody follows. Prohibit automatic forwarding of work email to personal accounts, a common route for data leaks and for attackers who take over a mailbox. Tell people exactly how to report a suspicious message, and keep sensitive information out of personal messaging apps unless the business has approved a secure channel.
Devices, personal phones, and remote work
Company devices stay locked when unattended, encrypted, and updated, and employees never disable security software or install tools that need administrator rights. If personal phones are used for work email or files, explain the required enrollment and what the company can and cannot see; the security risks personal devices bring are far easier to manage when expectations are set up front. For remote work, cover home networks, public wireless, shared family computers, and screen privacy, and set a short deadline for reporting a lost device, measured in hours rather than days.
Software, cloud apps, and AI tools
Keep a list of approved software and cloud services, which PCI DSS expects anyway, and give people a simple way to request something new. Company data belongs in company systems, not in personal cloud storage, personal email, or free tools signed up for with a work address. The request process matters as much as the ban, because staff route around rules that make them wait weeks for a basic tool.
AI tools need their own line. Name the approved tools and list the information that must never go into public AI services, such as client files, patient details, and passwords. Point to a separate AI policy if you have one, and review this section whenever a new tool arrives, because it ages fastest.
Handling data, and what is never allowed
Explain where each kind of information may be stored, how it may be shared, and how it is disposed of. The rules are easier to follow when they rest on data classification with a few plain labels such as public, internal, and confidential. Include removable media, printing, and paper, since USB drives and forgotten printouts still cause real exposures.
Keep the list of prohibited uses short and specific, because long lists get skimmed. For most small businesses it comes down to six things: sharing passwords or accounts, installing software or browser extensions that are not approved, turning off or bypassing security tools, moving company data through personal accounts or unenrolled devices, plugging in unknown USB drives, and using company systems for illegal activity, harassment, or a side business.
Reporting, enforcement, and the signature
Tell people how to report a mistake, such as a clicked link or a misdirected email, and make clear that fast, honest reporting is treated very differently from hiding a problem. Handle violations through your HR process and apply the rules the same way to everyone, owners included. End with a signature block that records the version number and date, collected at hire and every year.
How sample policy language should sound
Plain sentences work better than legal boilerplate. A password clause can be as simple as "You may not share your password or let anyone else, including coworkers, use your account." A forwarding clause can read "Work email may not be forwarded automatically to a personal email account." A device clause can say "Report a lost or stolen device to IT within four hours, including outside business hours," and an AI clause can say "Do not enter client, patient, or financial information into AI tools the company has not approved." Write the whole policy in the voice you use with your staff, then have employment counsel review the monitoring and enforcement sections before it goes out. Template language is a starting point, not a finished policy.
Rolling out the policy so it sticks
A policy emailed as an attachment and never mentioned again changes nothing. Walk through it in a short staff meeting and explain the reasons behind the few rules that matter most. Then fold it into your security awareness training so the examples people see match the rules they signed. Collect electronic signatures through your HR system or document platform, and add the policy to the onboarding checklist so new hires sign before they get accounts.
Review the policy every year, and sooner when something significant changes, such as a new AI tool, a move to remote work, or a new compliance obligation. Each review should produce a new version number and a fresh round of acknowledgments.
The strongest policies describe controls that already exist. Microsoft 365 can enforce multifactor authentication for every account, device management can block unapproved apps and require encryption, automatic forwarding to outside addresses can be turned off at the mail system, and USB storage can be restricted on company laptops. When the technology enforces the rule, the policy explains it instead of hoping people remember.
The same mistakes show up in policy reviews again and again: a template copied without changing the tools and devices it describes, language written for lawyers instead of employees, bans so broad that normal work breaks them daily, signatures collected once and never again, a policy that says nothing about AI or personal phones, and rules enforced for some people but not others.
Putting the policy to work
An acceptable use policy is one of the cheapest security controls a small business can adopt, and one of the few that auditors, insurers, and clients all ask about. GlobeVM has supported businesses for 30 years and currently looks after more than 75 organizations across Southern California. Firewall management, endpoint protection, email filtering, and multifactor authentication are standard in every plan, which covers several of the controls a good policy depends on. When you call, a person in Los Angeles answers in under 15 minutes, often George or Nazy, the owners, in English or Farsi.
If you want a policy that matches the controls actually running in your office, start with a free IT and security assessment or call (818) 405-9930.