5.10 Acceptable use of Information and Other Associated Assets

Rules for the acceptable use and procedures for handling information and other associated assets should be identified, documented, and implemented.

Acceptable use of information refers to the rules and guidelines that an organisation establishes for how its employees and other users are allowed to use the organisation's information assets.

These rules and guidelines are typically outlined in an acceptable use policy (AUP), which is a document that specifies the types of activities that are allowed and prohibited when using the organization's information resources.An acceptable use policy may include a variety of provisions, such as:

• Prohibitions on the use of the organization's information assets for illegal or unethical purposes.
• Rules for protecting the security and confidentiality of sensitive information.
• Restrictions on the use of the organization's information assets for personal purposes.
• Requirements for reporting security incidents or concerns.
• Guidelines for using the organization's email, internet, and other communication systems.
Acceptable use policies are an important part of an organisation's information security program, as they help to ensure that the organisation's information assets are used in a responsible and ethical manner, and that the security and confidentiality of those assets are maintained. By establishing and enforcing clear acceptable use guidelines, organisations can help to protect their information assets and maintain the trust of customers, partners, and other stakeholders.