3.7 KiB
3.7 KiB
Acceptable Use Policy
Document owner: [Owner/Role]
Approved by: [Steering Committee / CISO]
Effective date: [YYYY-MM-DD]
Review cadence: [Annually]
1. Purpose & Scope
This policy defines acceptable use of [Organization] systems, accounts, and data by all employees, contractors, and vendors with access to those systems.
2. Policy Statements
2.1 General Use
- Systems and accounts must be used primarily for authorized business purposes.
- Incidental personal use is permitted where it does not interfere with duties, consume disproportionate resources, or violate this policy.
2.2 Prohibited Activities
- Unauthorized access to systems or data outside one's role (see Access Control Policy §3.1).
- Disabling, bypassing, or circumventing security controls (MFA, endpoint protection, logging) without a documented exception.
- Sharing credentials or allowing account use by another person, including "temporary" sharing for convenience.
- Illegal activity, harassment, or use that damages [Organization]'s reputation.
2.3 Email & Communication
- Business email must not be used for unrelated personal accounts of consequence (banking, unrelated business ventures).
- Suspected phishing must be reported, not just deleted.
2.4 Cloud Services & Shadow IT
- New SaaS tools, including AI/LLM tools, must be approved before use with company data — unsanctioned tools create the "knowledge/AI leak" risk described in the organization's Antifragile Enterprise Manifest (Pillar 4: Sovereign Intelligence): data and reasoning sent to an unapproved third party is cognition the organization no longer controls.
- Approved AI tools must be used per any organization-specific data handling addendum; TLP:AMBER+STRICT/RED data (per Data Classification Policy) must not be submitted to a cloud AI service without verified contractual no-train/no-retain terms.
2.5 Personal & BYOD Devices
- Personal devices accessing company data must meet minimum security baseline (screen lock, encryption, current OS) — full BYOD/MDM requirements are covered in a dedicated device management policy where one exists.
2.6 Monitoring Notice
- [Organization] may monitor system and account usage as permitted by applicable law, for security and operational purposes. Users should have no expectation of privacy in company systems beyond what law requires.
2.7 Enforcement
- Violations may result in disciplinary action, up to and including termination of access or employment.
3. Antifragility Alignment
This policy is built to the five pillars of the organization's internal Antifragile Enterprise Manifest.
| Pillar | Applied In | How |
|---|---|---|
| 1. Structural Decoupling | §2.4 | Approval gate on new SaaS/AI tools prevents unmapped, unmanaged dependencies from silently accumulating |
| 2. Optionality Preservation | §2.4 | Requiring no-train/no-retain terms before sending sensitive data to a vendor preserves control over that data later |
| 3. Stress-to-Signal Conversion | §2.3 | Reported phishing (not just deleted) becomes signal that feeds security awareness and control updates |
| 4. Sovereign Intelligence | §2.4 | This is the pillar's most direct policy expression: shadow AI/cloud use is exactly the "AI leak" the manifest warns about |
| 5. Asymmetric Payoff Design (Barbell) | §2.4 | Extra scrutiny concentrated on AMBER+STRICT/RED data reaching AI tools; low-sensitivity personal use stays lightly governed |