Acceptable Use Policy Template

Use/reference this template as you build out your Acceptable Use Policy

Written By Micah

An Acceptable Use control refers to the existence of an Acceptable Use Policy (AUP) at the company. The policy outlines rules for the acceptable use by employees of company assets, the corporate network, and all technical infrastructure.

These may stipulate not to download additional apps, games, or engage in illegal behaviors with company assets. If working remotely, an AUP may require employees to have a password on their home network or utilize a VPN if logging in from a public location.

The control may state that all employees sign the acceptable use policy upon hire. This is a suggested practice, as it ensures that employees are aware of acceptable and unacceptable behaviors. It is not, however, 100% required for SOC 2 compliance for new hires to sign the AUP upon hire. If you prefer to omit this section of the control, that is acceptable from a SOC 2 compliance perspective.

Why is this control important?

Employee behavior is one of the biggest threats to security. An AUP is an integral document to mitigate the risk that negligent behavior can introduce a security threat.

What does evidence look like for this control?

This control has multiple evidence items linked:

  1. Acceptable Use Policy: This item is simply requesting a copy of the AUP policy document for the auditor to review. This evidence item is a great opportunity to utilize automatic collection from either Office 365 or Google Drive.

  2. Signed Acceptable Use Policy: If you opt to not require new hires to sign the AUP, you can deactivate this evidence item.

    1. For a Type 1 audit, upload the signed AUP for the most recent new hire.

    2. For a Type 2 audit, the auditor will select the specific sampled employees they want to see the signed policy for. They will select these sampled employees from the Employee List evidence item.

    3. Employee List: The auditor will use this list to determine which new hires they will request signed AUPs for. This evidence item can be provided via our HRIS integration.

How to use the template:

  • Click on the link above to access the template

    • If you are a Google Workplace organization, make a copy by going to File > Make a copy

    • If you are not a Google Workplace organization, download a copy by going to File > Download and selecting your preferred file type (available as DOCX, PDF, and more)

  • Review and then remove instructional text

  • Save in a centralized place

  • Attach to evidence either through Integrations, Automated Collection, or direct upload

Questions?

Reach out through our chat feature for real-time Customer Success support 8 am - 5 pm PT Monday through Friday.