Template 01
Acceptable use policy (small organization)
Sets out, in plain words, how staff and volunteers should use the organization’s accounts, devices and data, and what to do when something goes wrong.
How to adapt it
Replace everything in [square brackets]. Delete rules that do not apply rather than leaving them in. Read it through with a manager and, if you employ people, check it against your employment contracts and local law before you adopt it.
Preview the text
ACCEPTABLE USE POLICY ===================== [Organization name] Version [1.0], adopted [date] by [board or director]. Next review: [date]. How to use this template: replace everything in [square brackets], delete anything that does not apply, and keep it short enough that people will read it. This is a starting point, not legal advice. Check it against your employment contracts and local law before adopting it. 1. Why we have this policy -------------------------- We hold information about the people we serve, our staff, volunteers and supporters. They trust us to keep it safe. This policy explains how everyone who works with us should use our accounts, devices and data, so that one mistake does not put that trust at risk. 2. Who it applies to -------------------- Everyone who uses [Organization name]'s accounts, devices or data: employees, volunteers, trustees or board members, contractors and interns. It applies wherever you work, including at home. 3. Accounts and passwords ------------------------- - Use your own account. Never share your password or let someone else sign in as you. - Use a different password for every work account. Use [the password manager we provide / a password manager]. - Turn on multi-factor authentication (a second step after the password) wherever it is offered. It is required for email, [banking], [our client database] and [other systems]. - If you think anyone else knows your password, change it and tell [name or role] straight away. 4. Devices ---------- - Lock your screen when you step away. Devices must lock automatically after [a few] minutes. - Leave automatic updates switched on. Restart when asked. - Work devices must have disk encryption switched on. [Name or role] can check this for you. - If you use a personal phone or computer for work, it must have a screen lock, receive security updates and [other requirements]. Keep work files in [approved places], not on the device itself. - Report a lost or stolen device to [name or role] immediately, day or night, on [phone number]. 5. Email, messages and calls ---------------------------- - Be suspicious of unexpected messages asking you to sign in, open an attachment, pay something or keep a secret, even if they appear to come from someone you know. - Never change bank or payment details because of an email alone. Call back on a number you already had, and have a second person approve the change. - If you clicked something you should not have, say so straight away. Reporting quickly matters far more than the mistake, and nobody will be blamed for reporting. 6. Information about people --------------------------- - Store personal information only in [approved systems, e.g. our case management system and shared drive]. - Do not forward work email to personal accounts, or copy personal information to personal devices, USB drives or personal cloud storage. - Share only what the other person needs. Check the recipient before you press send. - Do not leave printed personal information on desks or printers. Shred it when it is no longer needed. 7. New software and online services ----------------------------------- Ask [name or role] before signing up for any online service that will hold the organization's information, even if it is free. This lets us keep track of where our data is and close accounts when people leave. 8. Personal use --------------- Reasonable personal use of work devices and accounts is [allowed / not allowed], as long as it does not interfere with work, break the law or put our information at risk. [Add any specific rules.] 9. Monitoring ------------- [Describe honestly any monitoring the organization does, for example security alerts on sign-ins or filtering of malicious websites, and why. If you do not monitor, say so. Any monitoring must be lawful and proportionate.] 10. When you leave or change role --------------------------------- Return all devices, documents and keys on your last day. Your accounts will be closed or handed over, and shared passwords you knew will be changed. Do not take copies of the organization's information with you. 11. Reporting a problem ----------------------- Tell [name or role] on [phone number] or [email] as soon as you notice anything wrong: a lost device, a suspicious message, a mistake, or something that just seems odd. Out of hours, call [phone number]. 12. If this policy is not followed ---------------------------------- Breaking this policy may lead to [access being removed / action under our disciplinary procedure]. Honest mistakes that are reported promptly are treated as a chance to learn. Acknowledgement --------------- I have read and understood this policy. Name: ______________________________ Signature: __________________________ Date: ______________ ------------------------------------------------------------ Template by Moraph for Good (https://moraph.org/commons/templates). Free to copy and adapt under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Attribution: "Moraph for Good".