Acceptable Usage Policy Template?

bazooka

Hi All,

Does anyone know of a good template for an AUP to give to employees that covers all the relevant legislation...we have a bit of a problem with the moment with someone who thinks its ok to not fo any work and thinks the email/internet/phone/fax are just there for to phone friends etc...

Any help or pointers are appreciated...

Bazooka...

carbsy

Show them their P45!

Karoma

"All your right are belong to us"

That is all.

Capt'n Midnight

That which is not expressly permitted is denied..
Also why HR depts exist.

Tell them how much internet costs - inc antivirus and firewalls etc.

You could remove their access (for technical reasons ) and fix it after an AUP is signed.

Phoning / faxing - that is a direct cost. - If calls are metered you could time them and point out that since they wern't work related they still have x amount of time to work up their 37.5 hours - suggest just before the bank holiday.

Also local libraries have free internet access - so they don't NEED it at work.

zenith

actually answering the question:

sans.org has all you need.

http://www.sans.org/resources/policies/Acceptable_Use_Policy.doc is a good template, and there's loads more on this page:

http://www.sans.org/resources/policies/

Gavin

An interesting point I came acorss the other day. Unless an AUP is actively enforced by management, it is not an effective defence in court to say that it was compromised. Tacit Approval was the term used. So if you get the AUP signed, be sure to stick some sort of banner on login screens and such advising that machines are being monitored, AUP must be adhered to, etc.

And ensure that logs are created, stored and checked out at least perfunctorily, reasonably regularly.

Gav

bazooka

thanks for all the info...especially zenith...having a detailed lok at that site now..

i think we will go with something like a sonicwall TZ170 with the content filtering subscription to block known sites and also just to keep the whole thing clean...you can also apply an AUP click box for all users who use internet explorer...logging is excellent to with email reports...

next question is does anybody know of a script that will make a popup message appear when a user logs in to the system?

seamus

Just from what I've have on my machine here..

In Local Security Settings -> Local Policies -> Security Options,
There are two entries under "Interactive Logon" called "Message text for users attempting to log on" and "Message title for users attempting to log on" which appears on the screen when the user presses Ctrl-Alt-Del to log in.

This is in my Local settings, but they use it in my work to enforce the AUP, so I assume it exists in the Domain Security Settings on the PDC too.

Other than that, if you will be using Domains and Domain Controllers, you can specify the default logon script for users, and in there you could have an "I agree to the AUP" bit.

bazooka

i found the local popup login mesage...very useful...

i also got two docs from ISME regarding acceptable usage...i will post them in the next few days...they are basic but good...