Question

Assume you are an IT manager and want to update your acceptable use policy (AUP). What is the purpose of the AUP and its importance within the user domain? Provide some controls that would fit in your company’s AUP.

Answer 1

What is AUP ?

Acceptable use policy (AUP) is a series of rules that define what end users may or may not do with their technology. It is basically a Risk Management term. This policy requires some kind of acknowledgement that the rules are well understood, including potential consequences of violation, before issuing any kind of access into the system.

Purpose of the AUP and its Importance :

An organisation that wants to protect any assets from a technology perspective must have an AUP. Unless you yourself define the rules for using your technology, there is no reason to expect your customers to act responsibly. To be frank, you may expect the users to abuse provided technology unless rules are clearly outlined.

Some controls that would fit in my Organisation's AUP :

(Note: A best AUP is not the one which locks everything down and restricts staff usage. The rules need to reasonable.)

A few items that need to be considered when drafting an AUP are listed below :

1. Consider impacts before establishing rules.

2. Clearly define what data matters in terms of privacy and why.

3. Define any compliance or legal concerns.

4. Solicit feedback from stakeholders and revisit policy.

5. Consider personally owned devices that access company data assets.