Acceptable Use Policy: The Eight Sections That Matter (With a Monitoring Clause)

An acceptable use policy is the least glamorous document in IT, and the one that decides whether your monitoring data is usable. Here is what actually needs to be in it, in the order a lawyer would ask for it.

What an acceptable use policy is for

Two purposes, and confusing them is common: telling employees what is expected of them, and preserving the company's ability to look at a device without arguing about whether it was allowed. A policy that only does the first is a staff handbook entry. A policy that does the second is an operational document — and it needs the monitoring clause.

The eight sections that matter

1. Scope. Which devices, accounts and networks are covered — company laptops, desktops, virtual desktops, mobile devices, and whether personal devices used for work are included (usually not monitored, sometimes partially).
2. Ownership. State plainly that company equipment and company accounts are company property, and that employees should have no expectation of privacy on them. Also state the exceptions you intend to honour, if any.
3. Permitted and prohibited use. Be specific: personal email on a work laptop, social media at lunch, installing software, using USB drives, connecting to public Wi-Fi.
4. Monitoring clause. What is recorded, when, and why. Not "we may monitor activity" as a catch-all — name the categories: screenshots, applications, websites, file transfers, USB devices, print jobs, attendance. Name what is not recorded, too.
5. Data handling. Who can see records, how long they are retained, how access is logged, and what happens if someone misuses access.
6. Attendance and working time. If you use check-in/check-out, define it: what counts as a punch, what happens when someone forgets, and whether the record is used for pay.
7. Consequences. What happens on a breach — and be realistic; a policy that threatens dismissal for a first accidental breach will not be applied consistently, and inconsistent enforcement weakens the whole document.
8. Acknowledgment. Signature or e-signature at hiring, plus a re-acknowledgment whenever the policy changes materially.

A monitoring clause you can adapt

The Company provides computers, accounts and network access for business purposes, and may monitor their use to protect Company data, to verify working time, and to investigate suspected misconduct. Monitoring may include periodic screenshots, records of applications and websites used, file operations, use of removable storage and printing, and attendance check-in and check-out.

Monitoring does not include reading the content of personal messages, and keystroke logging records counts rather than the text typed. Monitoring is limited to working hours or to periods between attendance check-in and check-out.

Records are available to HR, IT and line management on a need-to-know basis, are retained for a defined period, and are not used for any purpose outside this policy.

Adapt the specifics to what you actually configured. A clause that promises less than the software does is the fastest way to lose an argument.

Rolling it out without a revolt

• Publish the policy before the software. Announcing both on the same day reads as a fait accompli.
• Explain the business reason in one sentence a manager can repeat: "we need to prove who was on shift" beats "we're improving productivity".
• Show people their own record first. Nothing reduces suspicion faster than seeing that the data about them is boring.
• Set the retention period short enough to defend, long enough to be useful — three to twelve months covers most investigations.

Related

If you are still deciding what to record, start with the 30-minute rollout. If the question is what you must tell employees in your state, read the notice guide. WorkAuditor's FAQ includes a notice template.