What Is an Acceptable Use Policy? The Document Behind Every Monitoring Program
DIRECT ANSWER An Acceptable Use Policy (AUP) is the document that states how employees may use company systems, networks and devices - and what is prohibited. It is not the same as a monitoring policy, which states what the company collects, why and for how long. Monitoring programs need both, and most legal problems trace back to having one while pretending it is the other. THE TWO DOCUMENTS, SIDE BY SIDE - ACCEPTABLE USE POLICY: the rules for the user. What systems cover, permitted and prohibited use, security obligations, consequences of misuse - MONITORING POLICY: the disclosure to the user. What data is collected, the purposes, who can access it, retention, and how to raise questions One tells employees how to behave; the other tells them how they are observed. A monitoring program launched with only an AUP has announced rules but withheld the disclosure - the exact combination regulators and courts treat worst. WHAT A WORKING AUP CONTAINS 1. SCOPE: which systems, devices, account...