Template · Free
An acceptable use policy your staff will actually read
Most acceptable use policies are long, legalistic, and ignored. This one fits on two pages and says plainly what’s expected. Adapt it in an afternoon, have staff sign it, and you’ll have a real answer when a funder or insurer asks about your policies.
How to use this template
- Replace everything in [brackets], and delete anything that doesn’t apply.
- Have legal counsel or HR review it, especially the personal-device and monitoring sections, which vary by state.
- Ask every staff member, contractor, and volunteer with system access to sign it at onboarding and once a year.
The template
[Organization name] — Acceptable use policy
Effective: [date] · Owner: [name, title] · Applies to: all staff, contractors, volunteers, and board members who use our systems or data.
Why this matters
People trust us with sensitive information about [donors, clients, program participants]. Protecting it is part of our mission. This policy explains how we all help.
1. Accounts and passwords
Use a unique password for every work account, stored in our password manager. Keep multi-factor authentication turned on. Never share your login. If someone needs access, ask [IT contact] to set it up properly.
2. Organizational data
Use organizational data only for your work here. Store it in approved systems: [list, e.g., Microsoft 365, our CRM]. Don’t copy it to personal email, personal cloud storage, or USB drives. Share files with specific people rather than “anyone with the link.”
3. Devices
Keep devices that access organizational data updated, encrypted, and locked with a passcode or password. If you use a personal phone or computer for work, the same rules apply. Report a lost or stolen device to [contact] immediately so access can be removed.
4. Email and phishing
Be cautious with unexpected links, attachments, and requests. Always verify requests for money, gift cards, payment changes, or passwords by phone or in person, even if they appear to come from leadership. Report suspicious messages to [contact]. You will never be in trouble for reporting.
5. Software and AI tools
Only install software or connect apps that [IT contact] has approved. Don’t paste confidential, donor, client, or personal information into AI tools unless the tool has been approved for that use.
6. Personal use
Reasonable personal use of organizational devices and accounts is fine, as long as it doesn’t interfere with work, break the law, or put our data at risk. Organizational systems may be monitored for security purposes [adjust to your practice and state law].
7. Reporting incidents
If you think something has gone wrong, such as a clicked link, a lost device, or a strange login alert, tell [incident lead, phone] right away. Quick reporting is the single most helpful thing you can do.
8. When you leave
Return organizational devices and data, and don’t keep copies. Your access will be removed on your last day.
Acknowledgment
I have read and agree to follow this policy.
Name: ____________ Signature: ____________ Date: ________
Pair it with
The one-page incident response plan and the security essentials checklist. Together, they cover the basics most funders and insurers ask about. Want policies tailored to how you actually work? That’s part of every vCISO plan, or book a free intro call.
This template is a starting point, not legal advice. Employment and privacy rules vary by state.