IT and internet usage policy: devices, software, monitoring and AI tools

A new designer installs a free font manager from a forum. It comes with a browser extension that reads every page she opens, including the finance dashboard. Three weeks later the company is changing passwords across the board and asking who installed what. An IT and internet usage policy is the document that would have answered that question in advance.

The aim is to say what company technology is for, what is allowed, who approves exceptions and what the company can see. It is one of the core documents in the HR policies and governance set. Keep the tone practical, since employees will read it only if it is short and concrete.

Cover laptops, desktops, phones and accessories issued by the company, and refer to the asset and laptop policy for issue, care and return. State that the official email address is for company business, that company accounts belong to the company, and that staff must not auto-forward mail to personal addresses.

Passwords and multi-factor authentication belong in a separate access control policy, but this policy should require them and say where the rules live.

• Only licensed, approved software goes on company devices. Keep an approved tools list with a named owner.
• Browser extensions, plug-ins, IDE add-ons and mobile apps count as software and need approval.
• Files may be downloaded from trusted sources only. Cracked software and unknown installers are banned.
• Personal cloud storage and file transfer sites are not for company data.
• Unauthorised websites and services fall in categories the company lists, such as gambling, file-sharing swaps and anonymisers.

The trade-off is speed against control. Developers often need packages and tools faster than a weekly approval cycle can deliver. Decide whether engineers get a local administrator right with logged installs, or must raise a request. Many companies pick a fast-lane approval for known publishers and a slower review for the rest.

Approved tools: which email, chat, storage, code-hosting and design tools are allowed, and who owns each. Device permissions: who may install software, change settings or plug in external drives. BYOD rules: whether personal phones and laptops can reach company systems, under what conditions (screen lock, encryption, a work profile, remote wipe) and what the company may do if the device is lost.

Personal use is the next call. A short allowance for personal browsing is humane, and trying to ban it only produces secret workarounds. State the limits: no use that affects work, breaks the law or harms the company's name. Set the IT approval process: a request form, an owner, a service target in working days and who decides an exception.

Be honest with staff. If the company logs web traffic, scans email for malware, records badge access or tracks device location, say so, say why and say who can see the logs. Set monitoring limits: for example, security scanning on company devices and accounts, no reading of personal messages, and access to individual logs only through a documented request approved by a named person. Have the wording checked against the law on digital personal data by a qualified professional.

List the approved assistants, say what data may be entered, and ban pasting customer data, credentials or unreleased source code into unapproved tools. Decide who reviews AI-generated code before it merges, and whether AI notes of meetings need participants' consent. Pair this with the confidentiality policy, which sets the data labels.

1. 1

   Report

   The employee raises a ticket or calls the IT desk for loss, theft, suspected malware or damage. Loss or theft is reported within [number] hours.

2. 2

   Triage

   IT classifies the incident, locks or wipes the device if needed, and rotates affected credentials.

3. 3

   Approve exceptions

   A request for new software or an exception goes to the IT lead, who checks licence, security and cost, and records the decision on the tool request log.

4. 4

   Review

   A manager confirms the business need. Repeat violations pass to HR under the disciplinary policy.

5. 5

   Return and revoke

   On exit, IT collects devices, removes personal-device enrolments, revokes accounts and updates the asset register.

Set out how breaches are handled: from a coaching conversation for a small slip to formal action for deliberate misuse. Keep the approved tools list, tool request log, device register, BYOD enrolment records, incident register and signed acknowledgements. Review every year, and whenever a major tool or the monitoring approach changes.

Title and ID: HR-POL-012, owner [IT lead].
Purpose: safe, lawful and sensible use of company technology.
Scope: staff, contractors and interns using company systems or devices.
Equipment: issued by [role], covered by the asset policy.
Accounts: company email only for work, MFA required.
Software: only from the approved list at [location]; requests via [form].
Personal use: allowed within [limits]; not allowed for [list].
BYOD: permitted only if [conditions].
Monitoring: [what is logged], visible to [roles].
AI tools: approved [list]; no Confidential data elsewhere.
Incidents: report to [contact] within [number] hours.
Exit: devices returned, access revoked on [last working day].
Version, review and acknowledgement: v[number], [date], signed by each user.

We write and review policies like this for growing companies. Tell us about your tools and team on the requirements page, or see the full policy order guide.