AUP

A policy defining how employees may use organizational systems and data.

An AUP is a policy that defines acceptable and prohibited uses of organizational systems, networks, and data, setting expectations for employees and often acknowledged at hire or during onboarding. It supports security by establishing a basis for enforcement and disciplinary action when misuse occurs, such as installing unauthorized software or accessing inappropriate content. On the exam, place AUP among administrative or managerial controls and distinguish it from technical enforcement; the policy states the rules while other controls actually implement them.