What is AUP?
An acceptable use policy (AUP) is an organization's rulebook for its technology. It tells employees, contractors, students or guests what they may and may not do with company-owned computers, phones, network connections, email, internet access and cloud accounts. Users normally read and sign or electronically accept the AUP during onboarding, before they receive an account, and many organizations ask them to acknowledge it again on a schedule or whenever the policy changes.
The AUP is a policy document, not a technical control. Firewalls, web filters and Group Policy enforce some of its rules, but the signed AUP is what gives the organization a documented basis to act when someone breaks them.
What an AUP usually covers
- Personal use: whether limited personal browsing, email or streaming is allowed on work devices and during work hours.
- Prohibited activity: illegal downloads and piracy, harassment, offensive content, gambling, running a side business, or trying to bypass security controls.
- Software and devices: no installing unapproved software, no connecting unapproved USB drives or personal devices, and the rules for BYOD if it is allowed.
- Account security: no sharing passwords or badges, lock the screen when walking away, report lost devices and suspected phishing.
- Monitoring and privacy: a notice that the organization may monitor and log use of its systems, so users should not expect privacy on company equipment.
- Data handling: how to treat confidential data and PII, and where it may be stored.
- Consequences: what happens after a violation, from loss of access to termination or legal action.
Where you see an AUP in practice
New-hire paperwork is the classic place. Guest and public Wi-Fi networks often show the AUP on a captive portal page, and the user must accept it before getting internet access. Schools commonly have students and parents sign an AUP before laptops or tablets are issued. Many organizations also display a logon banner reminding users that the system is for authorized use and is monitored; in Windows this can be set through Group Policy with the interactive logon message settings.
For a help desk technician, the AUP answers everyday questions: may this user install a personal game or browser extension, and may a manager ask IT to review an employee's web activity? The technician follows and reports under the policy; HR and management decide on discipline.
AUP compared with other documents
| Document | Applies to | What it covers |
|---|---|---|
| AUP | Users of the organization's systems | Allowed and forbidden use of IT resources |
| NDA | Parties that share confidential information | Keeping specific information secret |
| EULA | A software vendor and the licensee | License terms for a software product |
| SLA | A service provider and a customer | Measurable service levels such as uptime and response time |
| SOP | Staff who perform a task | Step-by-step instructions for a routine job |
AUP on the CompTIA A+ exam
AUP is on the shared A+ acronym list. The topic belongs to Core 2 operational procedures, where it appears with other policy and documentation types.
- If a question describes a document every user signs that defines proper use of company computers, network and internet, think AUP.
- If a user is streaming, gaming, installing unapproved software or visiting banned sites on a work PC, the policy being violated is the AUP.
- If the question is about keeping business secrets private, think NDA; about software license terms, think EULA; about guaranteed uptime from a provider, think SLA.
- A guest Wi-Fi splash page that makes users accept terms before connecting is a common real-world AUP.