So I know what SHOULD be in an AUP. This question circulates more around how do I explain to my bosses the importance of having an AUP and ensuring everyone not only knows of it but understands the value and consequences of it.
We are an eCommerce company based on the East Coast that ship nationally and to several other countries. Our orders are all processed via the web by users on our operations teams that utilize their PCs/Macs to 1. Login to the admin consoles, 2. Manage Orders and 3. Handle administrative tasks and email
Are there any specific laws or studies that point to the value of needing an AUP for Internet Access and to safe guard confidential data?
EDIT - We DO handle Credit Card Info. We do not store the numbers (yet..internal debate and reasoning for this). Some people may have access to such data though (Even yb calling to our CC Gateway provider to get the number in certain cases). This means we are bound by PCI-DSS Requirements