Information Security Management
Acceptable Use Policy: What ISO 27001 Expects, What to Put In It, and a Free Template
An acceptable use policy tells the people who use your systems what they may and may not do with them. It is the one information security document that every member of staff is expected to have read, which makes it the most visible policy in an ISMS and the one most likely to be tested in an audit interview. ISO 27001 asks for it under Annex A control 5.10, and every certification auditor will want to see it, see that staff have signed up to it, and ask a couple of people what it says.
The complete toolkit, every policy, template and record you need. Free, no commitment
This guide covers what the control requires, what goes in a policy that works for a small business, a worked example, the mistakes I see most often as an auditor, and the template from our toolkit.
Free acceptable use policy template (Word)
The template is the acceptable use policy from our toolkit. It has every section in the table below with ready-to-use wording, placeholders for your company name and tools, and a version control table. Replace the placeholders, delete anything that does not apply to you, and have it approved and circulated.
It is one of 18 policy templates in the free ISO 27001 toolkit, alongside the procedures, registers and records for the rest of the ISMS.
What control 5.10 requires
Control 5.10, acceptable use of information and other associated assets, says that rules for the acceptable use and procedures for handling information and other associated assets shall be identified, documented and implemented. Three things sit inside that:
- Rules. What people are allowed to do with company equipment, accounts, data and networks, and what they are not.
- Documented. Written down, approved, version controlled, and available to the people it applies to.
- Implemented. Communicated to everyone in scope, acknowledged by them, and enforced when it is breached.
The control applies to employees, contractors, temporary staff and anyone else who uses your systems. The policy therefore needs to reach all of them, not just people on the payroll.
Why it matters more than it looks
Most security incidents in small businesses are not sophisticated attacks. They are a laptop left on a train, a spreadsheet emailed to a personal account, a password shared with a colleague, a USB stick of uncertain origin, or software installed from a download link. The acceptable use policy is where those behaviours are either ruled out in writing or left to chance.
It is also the document that gives you a basis for acting when something goes wrong. If a member of staff emails customer data to their own account and there is no policy saying they may not, the disciplinary conversation is much harder than it should be. Control 6.4, the disciplinary process, assumes an acceptable use policy exists.
What to put in it
A good acceptable use policy for a small business runs to three or four pages and covers the following. The table maps each section to the Annex A controls it helps evidence, which is useful when you build your Statement of Applicability.
| Section | What it covers | Annex A controls |
|---|---|---|
| Scope | Who it applies to (all staff, contractors, temps) and what (devices, accounts, networks, data, email, internet, phones) | 5.10 |
| Responsibilities | Line managers: grant and revoke access on need, recover devices from leavers. All staff: comply, report breaches | 5.2, 5.18, 6.5 |
| Access control | Keep credentials confidential, no sharing of accounts, approval before connecting personal devices or sharing data externally | 5.17, 8.1 |
| Internet and email | Reasonable personal use allowed within limits; no publishing company information without approval; no forwarding company data to personal accounts; no offensive content | 5.10, 5.14 |
| Clear desk and screen | Lock screens when away, do not leave confidential material unattended, dispose of printed matter securely | 7.7 |
| Remote and mobile working | Protect devices in public and in transit, avoid untrusted wi-fi, passcodes and encryption on all mobile devices | 6.7, 8.1 |
| Removable media | Use only when necessary, encrypt confidential data on it, do not share devices with non-staff | 7.10 |
| Transferring data | Encrypt confidential data in transit, send decryption keys by a separate channel | 5.14, 8.24 |
| Software | Respect licences, no installation without approval | 8.19, 5.32 |
| Malware | Do not bypass or disable antivirus, email filtering, web filtering or other protective tools | 8.7 |
| Leaving the organisation | Return all assets; company data and intellectual property stay with the company | 5.11, 6.5 |
| Monitoring | The company owns data on its systems, may monitor activity for security and misuse, and does so within UK law | 8.15, 8.16, 5.34 |
If you are a UK business, the monitoring section needs to be there and needs to be right. Monitoring staff activity without telling them is a data protection problem; telling them in the acceptable use policy, with the legal basis (Data Protection Act 2018, the Regulation of Investigatory Powers Act 2000 and the Lawful Business Practice Regulations 2000), is the standard way to handle it. If you have staff outside the UK, say that local law applies where it differs.
Worked example
Here is the internet and email section of a policy for a fictional 20-person software company, written the way I would want to read it as an auditor and the way a new starter could actually follow it.
Internet and email
You may use company email and internet access for reasonable personal purposes, provided it does not interfere with your work, does not expose the company to risk or embarrassment, and does not breach your employment contract or the law.
You must not:
1. Send company data to a personal email account, cloud drive or messaging app. The only exceptions are your own payslips and P60s.
2. Publish anything about the company, its clients or its work on social media, forums or elsewhere without approval from your line manager.
3. Send, forward or store material that is offensive, discriminatory or illegal.
4. Use company systems for personal commercial gain.
5. Download or share copyrighted material without a licence.
Company systems may be monitored for security and compliance purposes, as described in the Monitoring section below.
Notice what it is not: it is not a list of every website category that is blocked, it does not quote the control number, and it does not try to cover every case. It states the principle, gives the handful of hard rules, and points to where the detail lives.
Making it stick: the “implemented” part
The policy itself is the easy part. What auditors look for is evidence that it is in force:
- Acknowledgement. Every member of staff and every contractor signs or electronically acknowledges the policy at induction and whenever it changes materially. Keep the records; the auditor will sample them against the staff list.
- Awareness. The key points are covered in security awareness training (control 6.3) and repeated, briefly, at least annually.
- Enforcement. The disciplinary process (6.4) references the policy, and when a breach happens it is recorded as an incident and dealt with. One real example, properly handled, is worth more at audit than a perfect policy nobody has tested.
- Review. The policy has an owner, a version number and a review date, and it is actually reviewed. A policy approved three years ago that still names a tool you no longer use is a finding.
Mistakes I see most at audit
- No acknowledgement records. The policy exists; nobody can show who has read it. This is the most common finding against 5.10 by some distance.
- Contractors missed. The policy is in the staff handbook, so contractors and temps never see it.
- Twelve pages long. Copied from a large-company template, full of sections about mainframes and dial-up. Staff do not read it, and in interview they cannot say what it requires.
- Monitoring not mentioned. The company monitors email and web use but the policy is silent, which is a data protection exposure as well as a 5.10 gap.
- No personal use position. The policy either bans all personal use (which nobody follows, so it is unenforceable) or says nothing. State what is reasonable.
- Out of date. Still references the old antivirus product, the old office, the old managing director.
How it fits with your other policies
The acceptable use policy is the user-facing summary of several other documents. It should point to, not duplicate, the password policy, the mobile device and BYOD policies, the remote working policy and the data protection policy. In a small business these can be short sections of the acceptable use policy rather than separate documents; the standard does not care how many documents you have, only that the rules are identified, documented and implemented. The clear desk and clear screen rules and the cloud services rules are the two most often split out, and both have their own guides.
Where to go next
Control 5.10 is one of 93 in Annex A; see the full controls list and the Annex A guide for the rest, and the ISO 27001 policies hub for the other policy guides. If you are building an ISMS from scratch and would like help getting it to certification, our ISO 27001 consultancy service covers the policy set with you.
Frequently asked questions
Is an acceptable use policy required for ISO 27001?
Yes, in practice. Annex A control 5.10 requires rules for the acceptable use of information and associated assets to be identified, documented and implemented. An acceptable use policy is the normal way to meet it, and certification auditors expect to see one along with records that staff have acknowledged it.
What should an acceptable use policy include?
Scope and responsibilities; access control and credentials; internet and email use including personal use; clear desk and screen; remote and mobile working; removable media; transferring data; software and licensing; malware protection; what happens when someone leaves; and monitoring, with its legal basis. Three or four pages is enough for most small businesses.
Who has to sign the acceptable use policy?
Everyone who uses your systems: employees, contractors, temporary staff and anyone else with an account or a device. Keep the acknowledgement records; auditors sample them against the staff list.
Can staff use company email and internet for personal purposes?
The policy decides, but a blanket ban is rarely followed and so is hard to enforce. Most small businesses allow reasonable personal use that does not interfere with work, create risk for the company, or break the law, and state the hard limits (no company data to personal accounts, no offensive content, no commercial use).
Does the acceptable use policy need to mention monitoring?
If you monitor staff activity on your systems, yes. In the UK, telling staff in the policy that monitoring may take place, why, and under what legal basis is the standard way to meet both the ISO 27001 controls on logging and monitoring and your data protection obligations.
ISO 27001 Online Course + Full Toolkit
Stop guessing. Follow a proven step-by-step process.
“Highly recommended for anyone looking to understand ISO 27001, whether attempting it on your own or even using a consultant.“
Verified customer review
£285
Instant access
✓ Full toolkit included ✓ Learn as you build ✓ 12-month access ✓ 6 hours of video ✓ Call + email support
Author Background
This article was written by Alan Parker, an ISO 27001 consultant and founder of Iseo Blue Limited. He helps UK SMEs achieve certification in 90 days or less, often without a dedicated security team or a large budget.
With over 30 years in IT governance and information security, Alan works with software companies, IT service providers, managed service providers, and professional services firms across the UK, Europe, and internationally.
Qualifications: Certified ISO/IEC 27001:2022 Lead Auditor,
ITIL v3 Expert, ITIL v4 Bridge, PRINCE2 Practitioner. Named IT Project Expert of the Year (2024, UK). Alan writes in plain English for busy teams who need to get things done.
Connect on LinkedIn or Bluesky, or explore his free ISO 27001 tools and templates at iseoblue.com. B.Sc (Hons) Information Systems, CISMP certified.
