Writing an acceptable use policy for agency devices and networks

Reference article · 5 min read

An acceptable use policy sets the rules for how employees, elected officials, volunteers, and contractors use agency devices, accounts, and networks. It is one of the few technology documents everyone is asked to read and sign. It has to satisfy counsel, human resources, labor relations, and the records officer, and still be short enough that a public works crew member finishes it during onboarding.

Most acceptable use policies fail in one of two ways. Either they read as a liability shield nobody finishes, or they are copied from another jurisdiction and describe systems the agency does not run. A workable policy is specific to what you deploy, clear about what is prohibited, and honest about what is monitored.

Settle scope before you write rules

Scope disputes are where enforcement actions fall apart. Say who is covered: employees, temporary staff, interns, volunteers, elected and appointed officials, and contractors. Contractors are usually bound through their contract rather than the handbook, so the two documents need to match. Say what is covered: agency owned laptops, phones, and tablets, personally owned devices used for work, agency email and cloud accounts, the network including guest wireless, and agency data wherever it lives. It applies on duty and off, on premises and remote. Then define agency information, authorized user, and device in plain terms.

The sections the policy needs

Most agencies land on the same list.

• Permitted personal use. Say whether incidental personal use is allowed and what incidental means, with examples. Note that personal content on agency systems may still be subject to public records requests and retention schedules. Records and disclosure laws differ by state, so confirm with your records officer and counsel.
• Prohibited activity. Keep it concrete: illegal activity, harassment, circumventing security controls, installing unapproved software, running a private business on agency systems, and unauthorized access to records. Political activity restrictions vary by state, and some employees in federally funded positions face federal restrictions as well, so have counsel draft that line.
• Monitoring notice. State what the agency logs and inspects and that users should not expect privacy in agency systems. Notice and consent requirements vary by state, and login banners are commonly used to reinforce the notice.
• Credentials. No sharing of passwords or multifactor tokens, no use of another person's account, rules for shared and service accounts, no reuse of agency passwords elsewhere.
• Removable media and data movement. Whether USB storage is permitted, which cloud storage is approved, and an explicit ban on forwarding agency mail to personal accounts, which creates a security problem and a records problem at once.
• Reporting duties. How quickly to report a lost device, a suspected phishing message, or a possible disclosure, and to whom. Say plainly that prompt reporting is not a disciplinary matter.
• Generative AI tools. Which assistants are approved and what categories of data may never be entered into them.
• Consequences. Reference the discipline process that already exists rather than inventing a parallel one.

Remote wipe and personally owned devices

Remote wipe deserves a conversation with staff before it appears in a signed policy. A full wipe of a personally owned phone erases family photos along with agency mail. Most mobile management platforms also support a selective wipe that removes only managed applications and data, and the policy should say which one the agency will use and when. If staff carry agency mail on personal phones, address stipends or reimbursement, and ask counsel about wage and hour exposure when non exempt employees answer messages after hours.

Labor consultation and acknowledgement records

In many states, changes affecting working conditions carry a duty to bargain or to meet and confer with recognized employee organizations. Monitoring, discipline language, personal device expectations, and after hours availability are the clauses most likely to trigger that obligation. Bring labor relations in while the draft is still editable, and confirm the obligation with labor counsel.

Human resources will need durable acknowledgement records: name, policy version, and date, kept in the system you already use for training records. Build acknowledgement into onboarding, repeat it whenever the policy is revised, and decide whether annual renewal is required. Retain the records per your schedule, because they are the evidence that an employee was on notice.

Keeping it readable

Aim for a few pages of short sentences in the second person, with long definitions pushed into an appendix. Use examples rather than adjectives: "inappropriate use" is unenforceable, while "storing personal tax records on agency file shares" is clear. Before adopting, hand the draft to frontline staff with no technology role and ask what each section prohibits. Where they guess wrong, rewrite.

How it fits the suite, and how to start

The policy is the employee facing surface of several others: the information security policy, the mobile device standard, records retention, remote work, social media, and incident response. It should point to them rather than restate them, and only one document should own a given rule.

To get moving, inventory what you actually operate: mail and collaboration platform, device management tooling, network access. Draft against that inventory, then review it with IT, HR, labor relations, the records officer, and counsel in one working session rather than sequential markups. When buying the tooling that enforces the policy, ask vendors whether selective wipe is supported on both major mobile platforms, how long administrative and access logs are kept and whether you can export them, and what an administrator can see on a personal device. Put log retention, export on termination, and limits on administrative access in the contract.

HQT works with state and local agencies on cybersecurity and enterprise IT programs, including the device management tooling behind an acceptable use policy.

Frequently asked questions