Acceptable Use is a formal framework defining how employees and third parties are permitted to utilize an organization’s digital resources and information. A documented policy and user agreement is the primary requirement, delivering the business benefit of reduced liability and enhanced protection against insider security threats.
What is Acceptable Use?
Acceptable use refers to the rules and guidelines that define how people are allowed to use an organisation’s resources, such as computers, networks, and data. Think of it like a set of digital manners. These rules are in place to keep the organisation’s information safe and to ensure resources are used for their intended purpose.
Examples
- Email: An acceptable use policy would typically state that company email should be used for business purposes only, and not for sending personal jokes, political chain letters, or spam.
- Internet Browsing: It might limit access to certain websites, like those that are illegal, dangerous, or not related to work, to prevent malware infections and wasted time.
- Software: The policy would require employees to use only approved, licensed software and prohibit them from downloading or installing unapproved programs that could create security risks.
Context
An acceptable use policy is a crucial part of a company’s overall security strategy. It helps protect against threats from the inside, like employees accidentally introducing viruses, and ensures that everyone understands their responsibilities. By clearly defining what is and isn’t allowed, it helps prevent misuse and keeps the organisation’s valuable information secure. It’s essentially a straightforward agreement between an organisation and its users.
Relevant ISO 27001 Controls
The following controls from the ISO/IEC 27001:2022 standard are related to acceptable use:
- ISO 27001:2022 Annex A 5.10 Acceptable Use Of Information And Other Associated Assets: This controls requires rules for acceptable use to be put in place.
- ISO 27001:2022 Annex A 5.1: Policies for Information Security: Organisations should establish policies and procedures to ensure the security of their information.
- ISO 27001:2022 Annex A 6.7: Remote Working: This control applies specifically to remote work, ensuring that acceptable use rules are followed even when employees aren’t in the office.
How to implement Acceptable Use
To achieve compliance with ISO 27001 Annex A 5.10, organisations must establish clear rules for the acceptable use of information and assets. This implementation process ensures that every user understands their responsibilities, reducing the risk of data breaches and equipment misuse. Follow these ten technical steps to formalise your acceptable use framework and satisfy auditor requirements.
1. Catalog All Information Assets
- Update the central Asset Register to include all physical devices, software licenses, and cloud-hosted data sets.
- Identify the specific owners for each asset class to ensure accountability for usage rule enforcement.
- Verify that every item in the inventory has a unique identifier for tracking throughout its lifecycle.
2. Formalise the Acceptable Use Policy (AUP)
- Draft a comprehensive AUP that defines the expected behaviour for employees, contractors, and third-party vendors.
- Include specific clauses regarding the personal use of corporate equipment and the prohibition of illegal activities.
- Ensure the policy is written in clear language and approved by senior management to give it regulatory weight.
3. Define Technical Rules of Engagement (ROE)
- Document the ROE for high-risk systems, specifying exactly how administrators and users should interact with sensitive databases.
- Establish boundaries for penetration testing or security research to prevent accidental service disruption.
- Distinguish between standard user operations and privileged administrative actions within the documentation.
4. Align Usage Rules with Information Classification
- Map the AUP requirements to your Information Classification Schema, ensuring stricter rules for “Confidential” or “Secret” data.
- Specify handling instructions for different media types, including paper records, removable storage, and digital transfers.
- Identify prohibited storage locations for sensitive data, such as personal cloud drives or unencrypted devices.
5. Enforce Identity and Access Management (IAM) Roles
- Provision access based on the Principle of Least Privilege (PoLP), ensuring users only access assets required for their role.
- Integrate Multi-Factor Authentication (MFA) as a mandatory requirement for accessing any asset covered by the AUP.
- Automate role-based access controls to revoke permissions immediately when a user’s job function changes.
6. Deploy Security Monitoring and Logging
- Implement logging across all endpoints to track file access, login attempts, and policy violations.
- Configure Data Loss Prevention (DLP) tools to block the unauthorised transfer of sensitive information as defined in the AUP.
- Establish a process for regular log reviews to identify anomalies that may indicate a breach of acceptable use.
7. Execute Mandatory Awareness Training and Sign-off
- Roll out a security awareness programme that specifically covers the contents and consequences of the AUP.
- Capture a formal digital sign-off from every user acknowledging they have read, understood, and agreed to the rules.
- Maintain a version-controlled record of these sign-offs for presentation during an ISO 27001 certification audit.
8. Secure Mobile and Remote Access
- Extend the AUP to cover Bring Your Own Device (BYOD) and remote working scenarios through Mobile Device Management (MDM).
- Require the use of encrypted Virtual Private Networks (VPNs) for any remote access to the corporate network.
- Define clear rules for the use of company assets in public spaces, focusing on physical security and shoulder surfing risks.
9. Establish Asset Return and Offboarding Protocols
- Formalise the process for the return of all physical and logical assets when an individual leaves the organisation.
- Update the Asset Register to reflect the return and redistribution of equipment, ensuring no “ghost” assets remain active.
- Revoke all digital credentials and IAM roles as the final step in the offboarding workflow to prevent unauthorised post-employment access.
10. Conduct Periodic Compliance Audits
- Perform regular internal audits to verify that the AUP is being followed across different departments.
- Review the policy at least annually, or when significant changes occur to the IT infrastructure or threat landscape.
- Document any non-conformities and implement corrective actions to continuously improve the security posture.
Acceptable Use FAQ
What is acceptable use in a business context?
Acceptable use is a formal set of rules defining how employees and third parties must use an organisation’s digital assets, including hardware, software, and network services. In the UK, 90% of security breaches involve human error; therefore, an Acceptable Use Policy (AUP) serves as a critical preventative control to mitigate insider threats and ensure legal compliance.
What are examples of acceptable use violations?
Common violations of acceptable use that can lead to disciplinary action or security incidents include:
- Unauthorised Software: Installing “Shadow IT” or unapproved applications that bypass security protocols.
- Data Mismanagement: Transferring sensitive company data to personal cloud storage or unencrypted USB drives.
- Network Misuse: Accessing illegal, high-risk, or non-work-related streaming sites that consume excessive bandwidth.
- Identity Sharing: Sharing login credentials or multi-factor authentication (MFA) codes with colleagues.
Why is an acceptable use policy important?
An Acceptable Use Policy is vital because it establishes a legal and operational baseline for behaviour. It reduces corporate liability by 40% in some jurisdictions by proving the organisation took “reasonable steps” to prevent misuse. It ensures that resources are dedicated to business objectives while protecting the integrity, availability, and confidentiality of data.
How does acceptable use relate to ISO 27001?
Under the ISO/IEC 27001:2022 standard, Acceptable Use is explicitly required by Annex A Control 5.10. To achieve certification, an organisation must demonstrate that rules for the acceptable use of information and other associated assets have been identified, documented, and implemented through formal staff acknowledgement and regular awareness training.
The Tools We Use.
100% Audit Success. Zero AI Guesswork.
About the author
