An acceptable use policy tells people what they may and may not do with company systems and data. Keep it short, make each rule checkable, collect a written acknowledgment before granting access, and ask for a fresh one when the rules change.
What the control asks
NIST SP 800-53 PL-4 (Rules of Behavior) asks organisations to create rules describing user responsibilities and expected conduct for systems and information, including security and privacy duties, and give them to everyone needing access. Before granting access, collect a written acknowledgment that the person read, understood and agrees to follow the rules. Review the rules periodically and have users re-acknowledge them at a defined frequency or when the rules change.
What to include
Aim for one or two pages in plain language:
- Company devices. Encryption on, screen lock, updates installed, no disabling security tools.
- Accounts and passwords. Unique passwords, a password manager, multi-factor authentication, no sharing of credentials.
- Data handling. Where customer data may and may not be stored, no copying production data to personal devices or personal cloud accounts.
- Software. Who approves new tools, including browser extensions and AI tools. See blocking Chrome extensions company-wide.
- Personal devices. If allowed, the minimum conditions.
- Email, chat and social media. What not to share, and that company systems may be monitored if that is true and lawful where you operate.
- Reporting. Suspected incidents go to the named channel. See internal incident reporting rules.
- Consequences. Policy breaches can lead to disciplinary action, in line with HR policy.
Ask your employment lawyer to review monitoring and consequences language before publishing.
Write rules people can follow
"Do not use unapproved cloud services for company data" is vague. "Store customer data only in the approved systems listed on the wiki page" can be checked. Link the list and keep it current.
Avoid rules you will not enforce. A rule that everyone breaks teaches everyone to ignore the rest.
Collect acknowledgment properly
- Send the policy before the start date or on day one.
- Require a click-through or signature recorded with name, date and policy version.
- Do not enable access until acknowledged, as PL-4 describes.
- Store the records where you can export them for audits.
Re-acknowledgment
Choose a frequency, annually is common, and trigger one whenever the policy materially changes. Track who has not signed and chase them. Contractors and interns count too.
Pair with training
A signature is not understanding. Pair the policy with a short training session so the rules make sense. See building a security learning programme.
Safeguard's compliance and evidence automation can help track policy acknowledgments across your team as evidence for audits.
Quick check
Is the acceptable use policy the same as the employee handbook?
No. The handbook covers employment terms. The acceptable use policy covers conduct with systems and data. They can reference each other.
How long should it be?
Two pages or less. People read short documents, and short documents are easier to enforce.
Sources
Last reviewed: 19 October 2026.
