Policy Guide: Writing an Acceptable Use Policy People Will Read

Most acceptable use policies are written once, signed at hire, and never read again. They tend to be long, full of legal language, and disconnected from how people actually work. Then something happens, and the business discovers the policy either did not cover it or nobody knew what it said.

An acceptable use policy, or AUP, sets the rules for how employees use company systems, devices, accounts, and data. Done well, it is short enough to read, specific enough to follow, and backed by controls that make the right behavior the easy one. This guide walks through how to build one.

Why the AUP matters to the frameworks

The AUP is where security policy meets daily behavior, so it shows up across the frameworks our clients use:

• NIST Cybersecurity Framework 2.0. GV.PO covers establishing, communicating, and enforcing cybersecurity policy. PR.AT covers awareness and training so people can perform their tasks with security in mind.
• CIS Controls v8.1. Control 14 covers security awareness and skills training. An AUP gives the training something concrete to teach.
• HIPAA Security Rule. 45 CFR 164.310(b) requires policies that specify the proper functions of workstations that access electronic protected health information, how those functions are performed, and the physical surroundings. Security awareness and training is required under 164.308(a)(5).
• FTC Safeguards Rule. 16 CFR 314.4(e) requires security awareness training for personnel, updated to reflect risks identified by your risk assessment.

None of these frameworks hands you an AUP template. They expect you to write rules that fit your business.

Start with how people actually work

Before writing anything, spend an hour with a few people from different roles. Ask what devices they use, which apps they rely on, whether they work from home, how they share files with customers or patients, and what they do when IT is not available. You will find workarounds, personal apps, and shared accounts that the policy needs to address honestly. A policy that pretends those things do not exist will be ignored.

What to cover

Keep each section short and concrete. A useful AUP usually covers:

Accounts and passwords

• Accounts are personal and are not shared.
• Use a password manager and unique passwords.
• MFA is required on every system that supports it.
• Report any MFA prompt you did not request.

Devices

• Which devices may access company data, and the minimum requirements: supported operating system, screen lock, encryption, updates.
• Whether personal phones may be used for email or other apps, and what controls apply.
• Report lost or stolen devices immediately, any time of day.

Data handling

• Where company, customer, and patient data may be stored, and where it may not. Personal cloud storage and personal email are common examples to name explicitly.
• How to send sensitive information securely.
• No sensitive data on removable media unless approved.

Software and AI tools

• Only approved software may be installed.
• Which AI tools are approved, and what may never be pasted into them, such as patient information, customer financial data, or controlled technical drawings. If you need a starting point, our AI governance policy template covers this in more depth.

Email and payments

• Verify any request to change payment details or banking information by calling a known number, not one in the email.
• Report suspicious messages using the method you provide.

Remote and public work

• Lock screens when stepping away.
• Use only approved remote access methods.
• Be aware of who can see your screen in public places or shared clinical areas.

Monitoring and consequences

• State plainly that company systems may be monitored, consistent with applicable law. Have counsel review this section.
• Explain what happens when the policy is violated, and that honest mistakes reported quickly are treated differently from concealment.

Write it so people will read it

• Keep it to a few pages. Put procedures and technical detail in separate documents.
• Use plain language. Write "do not" instead of "users shall refrain from".
• Explain the reason for a rule when it is not obvious. People follow rules they understand.
• Use examples from your own business. A dental practice and a dealership have different risks.
• Include the reporting path. Every section should make it clear who to tell when something goes wrong.

Back the policy with controls

A policy that relies entirely on willpower will fail. Wherever possible, make the system enforce the rule:

• Enforce MFA and conditional access centrally.
• Remove local admin rights so unapproved software cannot be installed.
• Use device management to require encryption, screen lock, and updates.
• Block or restrict personal cloud storage and unapproved AI tools where practical.
• Give people a one-click way to report suspicious email.

The AUP then becomes the explanation for controls that are already in place, rather than a list of hopes.

Roll it out and keep it current

Have every employee acknowledge the policy at hire and at least annually. Walk through the key points in training instead of just sending the document. Assign an owner to review it at least yearly and whenever something significant changes, such as a new system, a new AI tool, or an incident. Keep the signed acknowledgments; they are part of your evidence for HIPAA, FTC Safeguards, and CMMC-related assessments.

How we help

TRNSFRM helps healthcare practices, dealerships, and manufacturers in Ohio write policies that match how they work and configure the controls that back them up. See our framework pages for HIPAA, FTC Safeguards, and NIST, and our industry pages for healthcare and automotive. Check your current state with the free compliance checklist, or book a free 45-minute Compliance Gap Audit.