Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Acceptable Use Policy (AUP) is a set of constraints and practices that users must agree and sign off to access the corporate network, endpoints, applications, and the Internet.
Information Security Policy is a statement of how the organization plans to protect the company's physical and information technology (IT) assets.
So is AUP part of the infosec policy?
In short 'Yes'.
For example, PCI-DSS defines a security policy as "Set of laws, rules, and practices that regulate how an organization manages, protects, and distributes sensitive information" and as such includes all (sub) security policies that may be specific to different technologies, practices and the AUP.
There is some disagreement over the term Security Policy with some organisations using this specific term to refer to a short (usually less than one page) statement about the organisation's stance on, and approach to, security i.e. a kind of security mission statement.
For most organisations however, an AUP is a key part of the Security Policy as a whole, as is the 'encryption of data at rest and in transit' policy, and the 'firewall change management policy' and the 'network and services audit and testing policy' etc. etc.
The two concepts are related, but distinct. A security policy is generally somewhat detailed, and goes into depth beyond what every end-user must worry about. However, not all aspects of the AUP are security concepts; for instance, my school's AUP has a line forbidding the use of the network to suggest the school's endorsement of a political candidate, except when approved by the general counsel's office. AUPs are legalistic policies intended to govern conduct on the system; this goes well beyond protecting the IT system and into protecting the organization itself.
Now, in some places the information security office is also in charge of policy and regulatory compliance, as the ideas are often intertwined. But AUPs are not inherently part of the security policy, because they aren't primarily designed to protect the integrity of IT systems; they're to enforce acceptable conduct even if it poses no security risk to the organization, and involves no risk to confidentiality, integrity, or availability.
