Acceptable Use Policy Framework Document

Note:  This document should be read in conjunction with the Lasa Knowledgebase article Acceptable Use Policies at www.lasa.org.uk/knowledgebase

Introduction

Who does this policy apply to?
•	Define your users 
•	Staff/volunteers/clients/trustees/management committee etc 

Why have an acceptable use policy?
•	Organisational policy 
•	Good practice 
•	Legal requirements 
•	User safety
•	Organisational security

How is it published & communicated to users?
•	Staff handbook 
•	Website/Intranet 
•	Displayed in training suites or appropriate areas
•	Part of induction process

Disciplinary procedure
•	What procedure will be followed if a user does not follow policy
•	Distinguish between one-off and persistent breaches of policy

General computer use

Usage
•	Personal/recreational use (email & web use dealt with separately)
•	Hardware use e.g. CD Writers, speakers 
•	Purchasing – sources, quotation & approval procedure
•	Disposal of life-expired equipment
•	User responsibility for care & safe keeping of hardware (especially laptops, handheld PDAs) 
•	Health & safety 
•	Food & drink precautions around PCs 

Software installation
•	By permission of systems administrator/manager – or only by named personnel
•	Licensing
•	Standardisation
•	Copying software
•	Installation on non-organisation equipment

File management
•	User responsible for filing documents as per agreed structure 
•	Storing documents on local & server drives 
•	Housekeeping 
•	Data amount limits 
•	Video, audio files 
•	Floppy disks 

Fault reporting/support
•	Who to report faults to 
•	Response times for fault assessment & fix

Disaster planning
•	Responsibilities
•	What plans

Email

Work-related use
•	Email client software to be used 
•	What is acceptable work-related use 
•	Any "house styles" - e.g. HTML or text 
•	Monitoring by organisation
•	Email etiquette observation

Personal use
•	Acceptable personal use (if any) 
•	Use of personal web mail addresses 
•	Amount of time permissible for personal use 

Anti-social or unacceptable usage
•	Passing on chain mail, jokes, links to websites, spam, animations, hoax virus warnings etc 
•	Think before you hit the send button! 

Signature files
•	What a signature file contains (name, job title, organisation, address, email & web addresses, company & charity numbers) & acceptable format 
•	When it must be used 

Attachments (sending & receiving)
•	Files not to be sent e.g. executable (.exe) 
•	Maximum permissible sizes of files 
•	"Zipping up" large files 

Viruses
•	see Security 

Mailbox management
•	Out of Office notifications 
•	Keeping old messages 
•	Use of "preview panes" 

Mailing lists
•	Permitted mailing lists 

Spamming
•	What to do with spam mail & care to be taken 
•	Avoidance of passing on 

Web & other online usage

Work related use
•	Are all staff allowed web access? 
•	Permissible use 
•	Use by organisation of site filtering software or services e.g. Webblocker 

Personal use
•	Acceptable personal use (if any) 
•	Time limited (lunchtimes/after work/no limits) 

Downloading
•	Large files such as music or video - may only be practical where there is a broadband connection
•	Streaming audio
•	Time limited (lunchtimes/after work) 

Offensive material
•	Defining the boundaries - what is not offensive to some may be to others 

Messaging/chat
•	Use of chat clients permitted by organisation? 
•	Time limited (lunchtimes/after work/no limits) 

Online purchasing
•	Allowed? Not allowed? 
•	Care when purchasing online 
•	Use of company accounts 

Security

General
•	Physical security of building (especially important where public access)
•	Marking equipment
•	Inventory & what it contains
•	Insurance policies (general equipment & cover for out of office for laptops etc) 

Data Protection
•	Requirements applicable to the organisation under Data Protection Act 1998 
•	Notification with Data Protection Commissioner 
•	What data is required to be collected & issues around sensitive data & privacy 
•	Procedures when personal data is requested by data subject 

Passwords
•	Network log-ons - format, frequency of changing, non-disclosure, publication 
•	Logging out of systems
•	Screensaver protection in public areas 

Back Ups
•	Who in the organisation is responsible (depends on ICT resources - e.g. the user will probably be responsible for standalone PCs, for a server, the network administrator) 
•	What will be backed up 
•	Frequency of back ups, media & routine used 
•	Onsite & offsite storage (fireproof safes etc)
•	Checks for restoring files & alignment of tape heads (if appropriate) 

Internet
•	Firewall installation & updating 
•	Use of software technologies such as Microsoft Proxy Server/IIS 

Anti-virus
•	Software used by organisation 
•	When updated & by whom 
•	Procedure to follow if virus detected 
•	Avoidance of virus contamination

Network administration
•	Who is responsible 
•	Brief description of responsibilities e.g. backing up data, server admin, reviewing users, license tracking, equipment auditing troubleshooting etc 

File management
•	Where users store documents (e.g. on fileserver or on local machine in My Documents)
•	Permissions policy (who has access to what)
•	Deletion policy (how long documents need to be kept for)

Training

Induction
•	What the induction consists of (e.g. introduction to the systems, file management, specialist software, AUP etc) 
•	When delivered 

Needs analysis 
•	When carried out (at supervisions, appraisals, independently) 
•	What training can reasonably be expected