Acceptable Use of Information and Other Associated Assets
Description
Rules for the acceptable use of information and other associated assets shall be identified, documented, and implemented.
⚠️ Risk Impact
Without an Acceptable Use Policy (AUP), staff actions that constitute misuse are legally ambiguous. Disciplinary actions for misuse require a clearly documented policy the employee acknowledged.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as medium-severity findings with remediation guidance.
🔧 Remediation
Publish an AUP covering: data handling, social media, AI tool use, BYOD, remote work. Require annual acknowledgement via HRIS. Update annually as the threat landscape and tool landscape evolve.
💀 Real-World Attack Scenario
An engineer pasted production customer data into ChatGPT to debug an issue (Apr 2023 Samsung-style incident). Investigation revealed no AUP covering AI tools; the company couldn't discipline the engineer because the action wasn't explicitly prohibited. They also couldn't establish negligence in the resulting data-leak claim.
💰 Cost of Non-Compliance
AUP-absent disciplinary cases: 78% lose in employment tribunal (UK ACAS 2024). GDPR liability for unsanctioned data sharing: up to €20M / 4% revenue.
📋 Audit Questions
- 1.Show the current AUP.
- 2.Does it cover AI tool use, BYOD, and remote work?
- 3.What is the annual acknowledgement rate?
- 4.Show last AUP update — what changed?
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔AUP that doesn't address AI tool use (most pre-2023 AUPs)
- ⛔Acknowledgement rates below 90% (auditors flag this)
- ⛔No mechanism to update AUP as new tools and threats emerge
📈 Business Value
Lived AUP provides legal defensibility for disciplinary action + audit-defensible evidence of governance.
⏱️ Effort Estimate
16-24 hours initial authoring + 4 hours annual refresh
EchelonGraph tracks acknowledgement via IdP/HRIS integration
🔗 Cross-Framework References
Automate ISO 27001 A.5.10 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →