Acceptable Use Policy

# Acceptable Use Policy ## 1. Purpose This policy defines the acceptable use of **[Company Name]** technology resources and data to protect our systems, customers, and employees. ## 2. Scope This policy applies to all employees, contractors, interns, and third-party users of company IT resources. ## 3. General Use ### 3.1 Company-Owned Devices - Must be used primarily for authorized business purposes - Must run approved endpoint protection (EDR/antivirus) - Must have disk encryption enabled (FileVault / BitLocker) - Must be kept up to date with OS and application patches - Must be locked when unattended (auto-lock within 5 minutes) ### 3.2 Personal Devices (BYOD) - Personal devices may access company resources only through approved MDM enrollment - Company data must not be stored locally on personal devices - Company reserves the right to remotely wipe corporate data from personal devices ## 4. Internet & Email Use ### 4.1 Acceptable - Business research, communication with clients and partners - Professional development and training - Limited personal use during non-work hours ### 4.2 Prohibited - Accessing illegal, offensive, or malicious websites - Downloading pirated software, media, or content - Using company email for personal commercial activities - Opening suspicious attachments or clicking unverified links - Sending confidential data to personal email accounts ## 5. Software & Applications - Only approved software may be installed on company devices - All software requests must go through the IT/Security team - Open-source software must be reviewed for licensing and security before use - Shadow IT (unapproved SaaS tools) is prohibited for processing company data ## 6. Network & System Access - Employees must use the company VPN when accessing resources remotely - Network scanning, packet sniffing, or penetration testing is prohibited without authorization - Sharing of network credentials or VPN access is prohibited - Use of proxy services to bypass content filtering is prohibited ## 7. Monitoring **[Company Name]** reserves the right to monitor, log, and audit all activity on company-owned systems and networks. This includes email, web browsing, file transfers, and application usage. Users should have no expectation of privacy when using company resources. ## 8. Enforcement - First violation: Written warning and mandatory security training - Second violation: Suspension of access privileges pending review - Severe or repeated violations: Termination of employment ## 9. Review This policy is reviewed annually. Employees must acknowledge this policy upon hire and annually thereafter. --- *Approved by: [Name, Title]* *Effective Date: [Date]* *Version: 1.0*