IT acceptable use policy template

1. Purpose

This policy protects the Company's systems and data, and the people who use them, by setting clear rules for acceptable use of the IT resources of [Company Name].

2. Scope

It applies to employees, trainees, interns, consultants and contractors who use Company devices, networks, email, software or cloud accounts, at the office, at home or while travelling. Personal devices used for work are covered in detail by the BYOD Policy.

3. Definitions

• IT resources: computers, phones, printers, networks, Wi-Fi, email, software, cloud storage and accounts provided by the Company.
• Security incident: any event that may expose Company systems or data, such as a lost laptop, a clicked phishing link or a virus alert.

4. Policy: acceptable use

• IT resources are provided for work. Brief personal use, such as a personal email or a train booking, is allowed if it does not affect work, security or network capacity.
• Use only software approved and licensed by the Company. Do not install anything yourself.
• Save work files on [Approved Storage], never on personal email or personal cloud drives.
• Use strong passphrases, turn on two-step login wherever it is offered, and never share passwords or OTPs, not even with IT staff.
• Lock your screen when you step away, and keep laptops with you when travelling, never in a parked car.

5. Policy: not allowed

• Accessing, downloading or sharing pornographic, violent, hateful or illegal material.
• Downloading pirated software, films or music, or using torrent sites.
• Plugging in unknown pen drives, or disabling antivirus, firewall or updates.
• Using Company email for chain messages, political campaigns or bulk personal mail.
• Pasting confidential, customer or employee information into public AI chat tools, translation sites or file converters that IT has not approved.
• Trying to access systems or data you are not authorised to use.

6. Monitoring

Company systems, email and internet traffic may be monitored and logged for security, compliance and investigations, in line with applicable law. Monitoring is done by authorised IT staff. The content of an individual's email or files is reviewed only for a specific reason and with written approval from [Designation].

7. Procedure for incidents and exits

• Report a lost or stolen device, a suspicious link you clicked or a virus alert to [IT Helpdesk Email or Phone] immediately. Early reports are never penalised.
• Do not try to investigate an incident yourself, and disconnect from the network if IT asks you to.
• Misuse is handled under the Disciplinary Action Policy, and access may be suspended during an investigation.
• On the last working day, IT disables all accounts and collects every Company device.

8. Responsibilities

• Users: follow this policy and report incidents at once.
• Managers: request access for their team members only for what their role needs.
• IT: maintain security controls, approve software, handle incidents and remove access on exit.
• HR: tell IT about joiners, role changes and last working days in good time.

9. Exceptions

IT may approve a documented exception, such as a specialised tool for a project, for a fixed period. Exceptions are recorded and reviewed when they expire.

10. Review

The IT head reviews this policy every [12] months and whenever the Company adopts a new category of tool or suffers a significant security incident.