Pentest Today.
Start free
security policy

Acceptable Use Policy

acceptable-use.md·SOC 2 · CC1.1

Generate an Acceptable Use Policy covering devices, accounts, and data — the staff-facing baseline every enterprise security review expects.

Generate this policyBrowse all policies

What's in the policy

Defines acceptable use of company systems, devices, and data by employees.

✓Permitted use of systems and accounts
✓Prohibited activities
✓Device, BYOD, and endpoint rules
✓Email, internet, and AI-tool use
✓Monitoring and privacy expectations
✓Consequences of violations
Mapped toSOC 2 (CC1.1)ISO 27001 (A.5.10)HIPAA

What the document actually says

These are the standing requirements every generated copy of the document is written from — the clause text itself, not a description of it. The document you receive is drafted on top of them: it expands on them and fills the current-state detail from your intake, and the generator is instructed to keep them, to state them fully, and never to claim a certification or invent a fact you did not supply.

What acceptable use requires

- Company systems and accounts are used primarily for authorized business purposes; incidental personal use must not interfere with duties or introduce risk. - Users protect their credentials, enable MFA, and never share accounts or passwords. - Devices used for company work are kept patched, use full-disk encryption, and lock automatically when idle. - Company and customer data is stored and transmitted only through approved systems and services.
SOC 2 CC1.1 · ISO 27001 A.5.10 — four affirmative duties: incidental personal use may not introduce risk, credentials are protected with MFA, devices stay patched and encrypted, and data moves only through approved systems.

What's off-limits outright

- Attempting to circumvent, disable, or probe security controls without authorization. - Installing unauthorized software or connecting unapproved services to company data. - Using company resources for illegal activity, harassment, or infringement of third-party rights. … - Sharing confidential information outside the company without authorization.
SOC 2 CC1.1 · ISO 27001 A.5.10 — bars probing security controls, installing unauthorized software, illegal or harassing use of company resources, and moving confidential information outside the company without authorization.

What monitoring the company reserves

…may monitor the use of its systems to the extent permitted by law and to protect its assets. Users have no expectation of privacy in company systems for this purpose. Suspected security issues, lost devices, or policy violations are reported promptly to the security contact.
SOC 2 CC1.1 · ISO 27001 A.5.10 — states the monitoring right in writing, removes any expectation of privacy on company systems, and names one channel for reporting a lost device or a suspected issue.

What the auditor asks for alongside it

Whether the device rule is followed on a specific laptop, not only written down.
An MDM or endpoint-management export for that device, read against the clause: company devices stay patched, use full-disk encryption, and lock automatically when idle. The document sets the requirement; the endpoint tool is what a reviewer samples against it.
Evidence that an unauthorized attempt to probe a security control would actually get noticed, not just that doing so is against the rules.
The penetration test report. The prohibited-use clause bars attempting to circumvent or probe security controls without authorization; a pentest is the one version of that activity anyone is allowed to run, under a signed scope, and its findings show whether an unauthorized attempt would be caught.
Which systems and services actually count as 'approved' for company and customer data, so the rule has a boundary instead of a word.
The system architecture and data-flow diagram generated alongside the policy set. It draws the specific stores and third-party services inside a named trust boundary, so 'approved systems and services' is a labeled set of boxes rather than a phrase left to interpretation.
Proof the monitoring clause is more than a right reserved on paper — that a reported issue was actually followed up.
The security-contact ticket trail. The policy names one channel for reporting a lost device or a suspected issue and states the monitoring right that backs it; the ticket trail is what shows the channel actually receives and closes reports, not just that the sentence exists.

Where these documents go stale

Most of what an acceptable use policy says barely depends on which company is reading it: MFA, encrypted devices, no shared passwords, and no probing a security control without authorization read the same at a five-person startup and a five-hundred-person one. That is why a blank current-implementation section does the least harm here — there is no environment-specific line to leave stale, because none was ever generated. What actually drifts is everything sitting outside the sentences: the list of systems and services in use grows every time a team adopts a new tool without asking, the named security contact changes when someone leaves, and a device fleet that was fully patched and encrypted on the day of the last review is not guaranteed to still be. Re-validating this document means checking the fleet and the contact, not editing the rules.

From intake to enterprise-ready in three moves
01

Tell us about your stack

Answer a short intake — cloud, data types, tools. No agents to install.

02

We generate a tailored draft

Not a blank template: a document written for your environment and pre-mapped to controls.

03

Review, edit, and share

Export it or attach it straight to an enterprise security review or questionnaire.

Acceptable Use Policy, answered

What is an acceptable use policy?

An acceptable use policy states how personnel may use company systems, devices, and accounts, what is prohibited outright, and what monitoring the company reserves the right to perform. It is the staff-facing companion to the more technical policies, written for anyone who touches a company system rather than for engineers or administrators.

What's typically prohibited under an acceptable use policy?

Probing or disabling a security control without authorization, installing unauthorized software, using company resources for anything illegal or harassing, and sharing confidential information outside the company without sign-off. Each is stated as an outright bar rather than a judgment call left to the person doing it.

Does an acceptable use policy cover AI tools?

An acceptable use policy touches AI only in passing — the prohibited-use section bars entering restricted data into unapproved third-party tools, AI included, and points to a separate AI Acceptable Use Policy for the specifics. Which tools are approved, what data classes they may see, and how AI output gets reviewed all live in that other document.

Does SOC 2 require an acceptable use policy?

In substance, yes. CC1.1 covers the control environment an organization sets for its people, and a documented acceptable use policy is the usual evidence a reviewer expects for it. This document is written against CC1.1 and mapped to ISO 27001 A.5.10, the pairing most reviewers work from.

Is incidental personal use of company systems allowed?

Yes, within a limit stated in the document itself: company systems and accounts are used primarily for authorized business purposes, and incidental personal use must not interfere with duties or introduce risk. It is a permission with a condition attached, not a blank allowance.

Who does this policy apply to, and does it cover personal devices?

Every employee, contractor, intern, and third party who accesses company systems or data, on any device used for company work — personally owned devices included. The scope does not stop at a company-issued laptop; it follows the work, not the hardware it happens to run on.

How does Pentest Today generate the policy?

Answer a short intake about your stack and we generate a tailored draft — not a blank template — pre-mapped to the controls your framework requires. You review, edit, and export it.

Can I edit the generated policy?

Yes. Every document is a starting draft you can edit, brand, and export. It's written to be review-ready but stays fully under your control.

Free · no account

Start your Pentest

Our agent swarm and human experts test your endpoints and deliver an audit, fast.

Start your PentestHow it works

More from the policy library

password.md→

Password & Authentication Policy

data-retention.md→

Data Retention & Deletion Policy

backup.md→

Backup & Recovery Policy

vuln-management.md→

Vulnerability Management Policy

security-training.md→

Security Awareness Training Policy

information-security.md→

Information Security Policy

Generate your full security policy pack.

Get the acceptable use policy plus everything else an enterprise security review asks for — generated from your real environment.

Get startedBrowse all policies