Acceptable Use Policy (AUP) for Small Business: What to Include
What an Acceptable Use Policy actually does
An Acceptable Use Policy, or AUP, is the document that tells your employees exactly how they are allowed to use company technology — laptops, phones, email, internet access, cloud accounts, and the data that flows through all of it. It is one of the most important security documents a small business can have, and also one of the most commonly skipped. Many owners assume that “common sense” covers it, but common sense is not a defense when an employee leaks customer data, installs unapproved software that introduces malware, or uses a company laptop for something that creates legal liability.
The AUP sets expectations in writing before a problem happens. It gives you a clear, consistent basis for action when someone violates the rules, and it demonstrates to insurers, auditors, and regulators that your business takes security seriously. If you ever pursue cyber liability insurance or a compliance certification, an AUP is one of the first documents you will be asked to produce.
Who needs one and when
Every business with employees needs an AUP, regardless of size. If you have even one staff member touching a company device or account, you have a reason to define acceptable use. The policy should be signed during onboarding, before a new hire is granted access to systems, and re-acknowledged annually or whenever the policy is updated. For contractors and temporary workers who use your systems, have them sign as well — they often have the same access as employees but none of the same accountability.
The core sections every AUP should include
Scope and ownership. Open by stating that company devices, accounts, and data are business property, and that the policy applies to everyone who uses them — employees, contractors, and temporary staff. Make clear that the rules apply whether the person is in the office, at home, or traveling.
Acceptable use. Define what company technology is for: legitimate business purposes. Spell out reasonable limits on personal use if you allow any. Many small businesses permit incidental personal use (checking a personal email at lunch) while prohibiting anything that consumes significant resources or creates risk.
Prohibited activities. This is the heart of the policy. List the things employees may never do: sharing passwords, disabling security software, installing unapproved applications, connecting unknown USB devices, accessing illegal or inappropriate content, or using company systems to harass others. Be specific enough that there is no ambiguity, but avoid trying to list every possible scenario — use categories.
Email and internet use. Address phishing awareness, the prohibition on sending sensitive data over unsecured channels, and the expectation that employees will not click suspicious links. Note that web traffic and email may be monitored and filtered.
Data handling. State how confidential and customer data must be treated — never copied to personal devices, never emailed to personal accounts, and never stored in unapproved cloud services. This single section prevents a huge share of accidental data loss.
Personal devices (BYOD). If employees use their own phones or laptops for work, define the security requirements: screen locks, encryption, the right to remote-wipe company data, and the prohibition on storing company data in personal apps.
Monitoring and privacy. Tell employees plainly that the company may monitor use of its systems. This both deters misuse and protects you legally — monitoring without notice can create legal problems in some jurisdictions.
Consequences. State that violations may lead to disciplinary action up to and including termination, and potentially legal action. Vague consequences get ignored; clear ones change behavior.
Sample language you can adapt
You do not need a lawyer to draft a usable first version. A workable acceptable-use clause might read: “Company systems and data are provided for business purposes. Employees must not share login credentials, install unapproved software, disable security controls, or transfer company data to personal accounts or devices. The company reserves the right to monitor use of its systems and to revoke access at any time.” From there, expand each idea into its own short section. Keep the language plain — a policy nobody understands is a policy nobody follows.
Rolling it out and making it stick
Writing the AUP is only half the job. The policy has to be delivered, acknowledged, and enforced consistently. Introduce it during onboarding and have each person sign electronically so you have a dated record. Walk through the key points in a short meeting rather than just emailing a PDF — people remember a five-minute explanation far better than a document they scroll past. Revisit the policy annually, because the technology your business uses changes, and a policy that does not mention cloud apps or personal phones is already out of date.
Enforcement matters as much as the document. If you let one violation slide, the policy loses its weight for everyone. Apply the rules evenly, document any violations, and connect the AUP to the rest of your security program — your password rules, your data backup approach, and your incident response plan all reference behavior the AUP governs. Treated this way, the AUP becomes the foundation that ties your whole security posture together, not just another form in the new-hire folder.
Common mistakes to avoid
The biggest mistake is making the policy so long and legalistic that nobody reads it. Aim for clarity over completeness. The second mistake is never updating it. The third is failing to enforce it consistently, which signals that the rules are optional. Avoid those three traps and a simple, plainly written AUP will do more to protect your business than a fifty-page document that sits unread in a shared drive.
How the AUP connects to the rest of your security program
An Acceptable Use Policy does not stand alone. It is the behavioral layer that sits on top of your technical controls, and it works best when it explicitly references the other policies your business relies on. Your password policy defines how credentials must be created and protected; the AUP is where you tell employees they must never share those credentials. Your data backup and recovery plan defines how data is protected; the AUP is where you prohibit employees from moving that data into unapproved places where it cannot be backed up or controlled. Your incident response plan defines what happens after a security event; the AUP is where employees agree to report suspicious activity promptly rather than hiding mistakes.
This interlocking design is what turns a collection of documents into an actual program. When an employee clicks a phishing link, the AUP is the reason they know to report it, the incident response plan is what guides your reaction, and your monitoring is what may have caught it. Each piece reinforces the others.
You do not have to write all of this from scratch. Reputable sources such as the SANS Institute and the National Institute of Standards and Technology publish free policy templates you can adapt, and many small businesses start from one of these and tailor it to their environment. The key is to make the final document your own — reflecting the actual tools your business uses and the actual risks you face — rather than adopting a generic template wholesale and never reading it again. A short, specific, well-understood AUP beats a long, borrowed one every time.
