# Acceptable Use Policy

**Document owner:** [Owner/Role]  
**Approved by:** [Steering Committee / CISO]  
**Effective date:** [YYYY-MM-DD]  
**Review cadence:** [Annually]

---

## 1. Purpose & Scope
This policy defines acceptable use of [Organization] systems, accounts, and data by all employees, contractors, and vendors with access to those systems.

---

## 2. Policy Statements

### 2.1 General Use
- Systems and accounts **must** be used primarily for authorized business purposes.  
- Incidental personal use is permitted where it does not interfere with duties, consume disproportionate resources, or violate this policy.

### 2.2 Prohibited Activities
- Unauthorized access to systems or data outside one's role (see [Access Control Policy §3.1](access_control_policy.md)).  
- Disabling, bypassing, or circumventing security controls (MFA, endpoint protection, logging) without a documented exception.  
- Sharing credentials or allowing account use by another person, including "temporary" sharing for convenience.  
- Illegal activity, harassment, or use that damages [Organization]'s reputation.

### 2.3 Email & Communication
- Business email **must not** be used for unrelated personal accounts of consequence (banking, unrelated business ventures).  
- Suspected phishing **must** be reported, not just deleted.

### 2.4 Cloud Services & Shadow IT
- New SaaS tools, including AI/LLM tools, **must** be approved before use with company data — unsanctioned tools create the "knowledge/AI leak" risk described in the organization's Antifragile Enterprise Manifest (Pillar 4: Sovereign Intelligence): data and reasoning sent to an unapproved third party is cognition the organization no longer controls.  
- Approved AI tools **must** be used per any organization-specific data handling addendum; TLP:AMBER+STRICT/RED data (per [Data Classification Policy](data_classification_policy.md)) **must not** be submitted to a cloud AI service without verified contractual no-train/no-retain terms.

### 2.5 Personal & BYOD Devices
- Personal devices accessing company data **must** meet minimum security baseline (screen lock, encryption, current OS) — full BYOD/MDM requirements are covered in a dedicated device management policy where one exists.

### 2.6 Monitoring Notice
- [Organization] **may** monitor system and account usage as permitted by applicable law, for security and operational purposes. Users **should** have no expectation of privacy in company systems beyond what law requires.

### 2.7 Enforcement
- Violations **may** result in disciplinary action, up to and including termination of access or employment.

---

## 3. Antifragility Alignment
This policy is built to the five pillars of the organization's internal **Antifragile Enterprise Manifest**.

| Pillar | Applied In | How |
|---|---|---|
| **1. Structural Decoupling** | §2.4 | Approval gate on new SaaS/AI tools prevents unmapped, unmanaged dependencies from silently accumulating |
| **2. Optionality Preservation** | §2.4 | Requiring no-train/no-retain terms before sending sensitive data to a vendor preserves control over that data later |
| **3. Stress-to-Signal Conversion** | §2.3 | Reported phishing (not just deleted) becomes signal that feeds security awareness and control updates |
| **4. Sovereign Intelligence** | §2.4 | This is the pillar's most direct policy expression: shadow AI/cloud use is exactly the "AI leak" the manifest warns about |
| **5. Asymmetric Payoff Design (Barbell)** | §2.4 | Extra scrutiny concentrated on AMBER+STRICT/RED data reaching AI tools; low-sensitivity personal use stays lightly governed |

---

## 4. References
- **[ISO/IEC 27001:2022](https://www.iso.org/standard/27001)**  
- **[CIS Controls v8.1](https://www.cisecurity.org/controls/v8-1)**