How to convince the boss of an Acceptable Use Policy

Question

So I know what SHOULD be in an AUP. This question circulates more around how do I explain to my bosses the importance of having an AUP and ensuring everyone not only knows of it but understands the value and consequences of it.

We are an eCommerce company based on the East Coast that ship nationally and to several other countries. Our orders are all processed via the web by users on our operations teams that utilize their PCs/Macs to 1. Login to the admin consoles, 2. Manage Orders and 3. Handle administrative tasks and email

Are there any specific laws or studies that point to the value of needing an AUP for Internet Access and to safe guard confidential data?

EDIT - We DO handle Credit Card Info. We do not store the numbers (yet..internal debate and reasoning for this). Some people may have access to such data though (Even yb calling to our CC Gateway provider to get the number in certain cases). This means we are bound by PCI-DSS Requirements

Answer 1

The strongest case for AUP is that you can address or discipline risky behaviour before it bites you rather than having to mop up afterwards.

On the compliance front there is the issue of employer liability for employee actions on the Internet (which I believe is an issue in the US). If the workstations handle or share a network with systems which handle credit card data you could also invoke the final requirement of PCI-DSS which states that you must "Maintain a policy which addresses information security".

Answer 2

Two key points that really should sell this:

• If you don't have a policy, the law appears to assume that you implicitly approve all behaviour by your staff. So you may take on liability for your staff committing crimes using your systems. (caveats - I am not a lawyer, and I really have only seen this in the UK and US)
• If you don't have a policy that defines the activities you wish to prohibit, and that is signed up to by all employees, you will also find it difficult to take disciplinary action if they do something you find unacceptable.