Acceptable use of information and other associated assets

Why it matters

Sets the baseline for what staff can and can't do with company systems and data.

How a self-led small team implements it

A one-page acceptable use policy acknowledged at onboarding covers this for most small teams.

What auditors expect to see

Signed acceptable use policy, onboarding checklist.

More organizational controls

• A.5.1 Policies for information security
• A.5.2 Information security roles and responsibilities
• A.5.3 Segregation of duties
• A.5.4 Management responsibilities