IT Policy Templates: Acceptable Use, BYOD, and Passwords

Most companies don’t realize how much risk they carry until something goes wrong. A worker loses a laptop with customer data. Someone uses their personal phone to check work email and gets hacked. A password gets shared across three teams and ends up in a data breach. These aren’t rare accidents-they’re predictable outcomes when there’s no clear IT policy in place.

Having a written policy isn’t about bureaucracy. It’s about setting boundaries so people can work safely, quickly, and without fear. The three most important policies every business needs? Acceptable Use, BYOD, and Password policies. Not because they’re trendy, but because they stop the most common IT disasters before they start.

Acceptable Use Policy: What You Can and Can’t Do

Your Acceptable Use Policy (AUP) is the rulebook for how employees interact with company tech. It covers everything from web browsing to downloading software. Most people think it’s just about blocking social media. It’s not. It’s about protecting data, systems, and your reputation.

Here’s what a real AUP includes:

• Prohibits using company devices for illegal activity-like downloading copyrighted movies or running crypto mining software
• Restricts installing unauthorized apps or browser extensions that could leak data
• Clarifies that company email and network activity can be monitored (and why)
• States that personal use is allowed in moderation-like checking a personal email during lunch-but not during work hours
• Requires reporting suspicious activity, like phishing emails or strange pop-ups

A company in Oregon lost $87,000 last year because an employee used a work laptop to run a Bitcoin miner. The device overheated, crashed, and took down the entire server room. That didn’t happen because the employee was evil. It happened because there was no clear rule saying it was forbidden.

Your AUP doesn’t need to be 20 pages long. It needs to be specific, easy to read, and enforced consistently. Post it where everyone can see it. Require everyone to sign it annually. Treat it like a safety manual-not a legal document.

BYOD Policy: When Personal Devices Touch Company Data

More than 68% of employees now use their own phones or laptops for work. That’s convenient. It’s also dangerous.

A BYOD policy isn’t about stopping people from using their devices. It’s about controlling how those devices interact with your systems. Without one, you’re giving strangers access to your network.

Here’s what a working BYOD policy looks like:

• Devices must have automatic encryption turned on (iOS FileVault or Android Full Disk Encryption)
• Remote wipe capability must be enabled-you can erase company data if the phone is lost or stolen
• Only approved apps can access company email or cloud storage (like Microsoft Intune or Google Workspace Device Management)
• Personal apps that collect location, contacts, or camera access are blocked from running while connected to the corporate network
• Employees must update their device OS within 14 days of a security patch

One tech startup in Portland had a data leak because an employee’s kid downloaded a free game on their iPad. The game had a hidden backdoor. It connected to the company’s Slack workspace and stole login tokens. That wouldn’t have happened if the BYOD policy had blocked unapproved apps from accessing work apps.

Don’t assume people know how to secure their own devices. Give them clear steps. Offer free tools. Help them set up device management. Make it easy to comply-and hard to mess up.

Password Policy: The First Line of Defense

Passwords are still the #1 cause of breaches. Not because hackers are smart. Because people use the same password everywhere. Or write it on a sticky note. Or use “Password123”.

A good password policy doesn’t force you to use “!@#$%^&*()” in every password. It removes the guesswork.

Here’s what works in 2026:

• Minimum 12 characters-no more 8-character limits
• Allow passphrases: “BlueCoffeeMug$2026” is stronger than “P@ssw0rd!”
• No password expiration unless there’s evidence of compromise
• Mandatory two-factor authentication (2FA) for all accounts-no exceptions
• Blocked passwords: no reuse of the last 5 passwords
• Use a company-managed password manager (like Bitwarden or 1Password Teams)

A 2025 report from the Identity Theft Resource Center showed that 82% of breaches started with a weak or reused password. The fix? Simple. Stop letting people create their own passwords. Give them a tool that generates and stores them securely.

One small accounting firm switched to a password manager and cut login-related helpdesk tickets by 70%. Employees didn’t have to remember passwords. They didn’t have to reset them every 90 days. They just logged in once and stayed logged in.

Putting It All Together

These three policies aren’t separate. They’re connected.

If someone uses their personal phone (BYOD) to check work email, and that phone doesn’t have encryption, and the password is “123456”, you’ve got a perfect storm. One weak link breaks the whole chain.

Start with the password policy. It’s the easiest to fix. Then add the BYOD rules. Then lock down acceptable use. Roll them out one at a time. Train people. Show them real examples. Let them see what happens when things go wrong.

Don’t wait for a breach to act. If you don’t have these policies, you’re already at risk. And if you have them but never updated them since 2019? You’re just as vulnerable.

Template Checklist

Here’s a quick checklist to build your own policies:

• ✅ Acceptable Use: Does it ban risky behavior? Does it allow reasonable personal use?
• ✅ BYOD: Does it require encryption? Remote wipe? App restrictions? OS updates?
• ✅ Password: Does it require 12+ characters? 2FA? A password manager? No expiration unless needed?
• ✅ Enforcement: Is there a process to report violations? Are consequences clear?
• ✅ Training: Have employees read and signed each policy? Is it reviewed yearly?

These aren’t checkboxes. They’re shields. Every one you put in place reduces your chances of a breach.

Common Mistakes to Avoid

• Using vague language like “use good judgment” instead of clear rules
• Forgetting to include contractors and third-party vendors
• Not updating policies when software changes (like switching from Outlook to Gmail)
• Letting IT handle it alone-this needs HR, legal, and management input
• Only enforcing policies on some people

If your policy says “no personal devices” but managers use their iPhones daily? You’ve lost credibility. Policies only work when they’re fair and consistent.