Most small businesses either have no acceptable use policy or copied one from a university — and both fail for the same reason: nothing in them is actually enforced.
- An acceptable use policy sets out what staff may and may not do with company IT — devices, email, internet, data and accounts.
- It only works if it matches what your systems actually enforce. A policy banning something your configuration still permits is a document, not a control.
- A small business usually needs three short policies, not one long one: acceptable use, BYOD, and password and access.
- Keep it to two or three pages, in plain English, signed at onboarding and reviewed annually. Length is not rigour.
What an acceptable use policy is for
An acceptable use policy defines what staff may and may not do with company IT — the devices, email, internet, data and accounts the business provides. Treat it as an operational control, not paperwork. Its real job is to make expectations explicit before there is a problem, so that when something goes wrong the conversation is about a known rule.
It rarely stands alone. A small business needs three short documents that together form its IT policy — acceptable use, BYOD, and password and access:
What to include
Start with scope — who the policy covers. Most small-business policies name employees and forget contractors and casuals, who touch the same systems. Then work through the rest:
- Scope — who it applies to, including contractors and casuals
- Company devices and equipment
- Email and internet use
- Software installation rules
- Data handling and confidentiality
- Personal use boundaries
- Monitoring statement
- How to report an incident
- Consequences of a breach
- Review date
- University or government clauses that do not apply to you
- Technical configuration detail that dates immediately
- Anything you cannot or will not enforce
- Legal boilerplate that makes it unreadable
Each item needs a sentence or two. The consequences and monitoring lines are the ones most often skipped and most needed — and where your wider IT compliance becomes concrete.
What to leave out
The usual failure mode is a policy copied from a university or US template — full of clauses that do not apply to an Australian small business. It reads as thorough and governs nothing.
Two rules keep it honest: leave out anything you will not enforce — an unenforced clause teaches staff the rest is optional too — and keep technical configuration in a standard your IT team maintains, not in a policy staff sign and never reread.
The monitoring statement
If your business monitors email, internet or device use, the policy must say so. It is the clause copied templates most often omit — and the one that matters when something goes wrong. State that monitoring occurs and why. This is a principle, not legal advice: confirm your obligations before publishing.
BYOD: the policy most small businesses skip
Personal phones and laptops holding company email and files are the norm in a small business, and almost always unaddressed. A BYOD policy decides how far you allow that — three genuine positions, and most businesses sit in the third without ever choosing it.
Company data lives only on company-managed devices.
Consequence: simplest to control; you must supply a device to everyone who needs mobile access.Personal devices are allowed, but company data is kept in a managed, separable space.
Consequence: flexible and common; requires management tooling and a clear line between company and personal data.Staff use their own devices freely for company email and files.
Consequence: nothing to buy and nothing under control — company data leaves with the device, and the person.The question that makes it concrete: when someone leaves with their own phone, what happens to the company email and files on it? If you cannot answer, you are at position three by default.
Making the policy match reality
A policy is only as good as the configuration behind it. If it says staff may not install software, the devices should not permit it. When document and systems disagree, staff follow the systems — and the policy becomes a liability you have signed.
This is where an acceptable use policy stops being an HR formality and becomes part of how you run cyber security for small business: the document states the rule, the configuration enforces it.
“Almost every policy we read says staff can’t install their own software. Almost none of the machines are set up to stop them. The rule was written once and never turned into a setting.”— PIP, from IT policy reviews
How often to review it
Review the policy annually, and whenever something material changes — new systems, new work arrangements, or an incident. Sign it at onboarding and re-acknowledge on review, so consent stays current. Keeping policy and configuration aligned is ordinary managed IT services work, not a one-off project.
This article is general information, not legal advice. Employment and monitoring obligations vary — confirm yours before publishing a policy.
Common questions
What does an acceptable use policy include?
What should not be part of an acceptable use policy?
What is an acceptable use agreement?
What are the consequences of non-compliance with an acceptable use policy?
Does your IT policy match what your systems allow?
PIP reviews IT policy against real configuration for Sydney businesses — so the document and the systems say the same thing.
Review my IT policy →