So I know what SHOULD be in an AUP. This question circulates more around how do I explain to my bosses the importance of having an AUP and ensuring everyone not only knows of it but understands the value and consequences of it.

We are an eCommerce company based on the East Coast that ship nationally and to several other countries. Our orders are all processed via the web by users on our operations teams that utilize their PCs/Macs to 1. Login to the admin consoles, 2. Manage Orders and 3. Handle administrative tasks and email

Are there any specific laws or studies that point to the value of needing an AUP for Internet Access and to safe guard confidential data?

EDIT - We DO handle Credit Card Info. We do not store the numbers (yet..internal debate and reasoning for this). Some people may have access to such data though (Even yb calling to our CC Gateway provider to get the number in certain cases). This means we are bound by PCI-DSS Requirements

2 Answers 2


The strongest case for AUP is that you can address or discipline risky behaviour before it bites you rather than having to mop up afterwards.

On the compliance front there is the issue of employer liability for employee actions on the Internet (which I believe is an issue in the US). If the workstations handle or share a network with systems which handle credit card data you could also invoke the final requirement of PCI-DSS which states that you must "Maintain a policy which addresses information security".

  • Thanks. I'll edit but yes we will be required to be PCI-DSS Compliant so this will help greatly! Feb 22, 2011 at 19:44

Two key points that really should sell this:

  • If you don't have a policy, the law appears to assume that you implicitly approve all behaviour by your staff. So you may take on liability for your staff committing crimes using your systems. (caveats - I am not a lawyer, and I really have only seen this in the UK and US)
  • If you don't have a policy that defines the activities you wish to prohibit, and that is signed up to by all employees, you will also find it difficult to take disciplinary action if they do something you find unacceptable.
  • Can you reference any specific case for your first point regarding implicit approval? Feb 22, 2011 at 19:44
  • Sadly, no. And my point was very sweeping as I don't know enough of the detail. Suffice it to say the three companies involved were all told they could have taken appropriate controls but didn't, and they ended up paying fines.
    – Rory Alsop
    Feb 22, 2011 at 19:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .