Most ISO 27001 policies are tested on paper. The auditor open the document, checks it against the clause, ticks the box and moves on. The acceptable use policy is different. It gets tested on people. Halfway through the audit they might walk over to somebody at their desk and ask simple questions. Can you install software on this laptop? Who told you that? Where is it written down?
That is the difficulty with acceptable use. You cannot fix it with better drafting. If your team has never read the rules, no amount of formatting saves the finding. This guide covers what the acceptable use policy ISO 27001 asks for, what belongs inside it and the India clauses most downloaded templates leave out.
What is the acceptable use policy?
An acceptable use policy is a set of rules for how people use company information and the assets holding it. Laptops, phones, email, cloud apps, printed documents, removable drives and network access all sit inside its scope.
It answers three questions for every person with access:
- What you may do: approved tools, approved devices, approved ways to share information
- What you must not do: shadow software, shared passwords, personal cloud storage for company files
- What happens if you do it anyway: the link to the disciplinary process
Note the audience. It applies to employees, contractors, interns, consultants and relevant third parties. Not just full-time staff.
What the acceptable use policy ISO 27001 requires
The control is Annex A 5.10, “Acceptable use of information and other associated assets”. It sits under organisational controls and asks you to identify, document and implement rules for use and handling. Note what it does not say. ISO 27001 never names a document called an acceptable use policy. The rules can sit in one policy or across several. What gets audited is whether they exist and are followed, not the file name.
That wording matters if you are working from an older document. In ISO 27001:2013, acceptable use and handling sat under separate controls, including A.8.1.3 and A.8.2.3. The 2022 edition brings both together under A.5.10.
ISO/IEC 27002:2022 guidance for 5.10 also covers authorising disposal and the deletion methods you support. Keep that distinct from A.8.10 Information deletion, a separate control for erasing data you no longer need. An acceptable use of assets policy ISO 27001 carried over from 2013 is usually silent on both.
7 practical sections every acceptable use policy needs
ISO 27001 prescribes no structure. In practice, the acceptable use policy ISO 27001 covers seven things:
- Scope and audience: Name every group covered. Employees, contractors, vendors and anyone using a personal device for work.
- Asset and information handling: Rules per classification level. How confidential data is stored, shared, printed and transferred.
- Personal devices: What BYOD access is permitted, what is blocked and what happens to company data when someone leaves.
- Approved software and cloud tools: A named list beats a vague principle. State how staff request something new.
- Monitoring disclosure: Say plainly what the organisation logs and reviews. This carries legal weight in India.
- Disposal and deletion: Who authorises disposal and which deletion methods are approved.
- Acknowledgement and enforcement: A dated record that each person accepted the rules, plus the route to the disciplinary process under Annex A 6.4.
The India layer most templates miss
Imported templates are written for a Western legal backdrop. Three Indian rules change what the acceptable use policy ISO 27001 expects you to say.
- The monitoring basis is still shifting: the Digital Personal Data Protection Act, 2023 commenced in phases. Section 7, covering employment-purpose processing, applies from 13 May 2027. Until then the IT Act 2000 and SPDI Rules 2011 govern. Record the basis you rely on and say plainly what you monitor
- Incident reporting is a staff duty: where the CERT-In directions apply, listed incidents must be reported within six hours of noticing. Not achievable if employees do not know who to tell. Put the internal reporting route in the policy
- Log retention shapes the monitoring section: covered entities must keep ICT logs 180 days within India. Your monitoring disclosure should match what you actually retain
For BFSI teams, this document also gets shared during client due diligence.
The clause most policies are still missing
Ask where company data actually leaks today and the answer is rarely a firewall. It is someone pasting a client contract into a chatbot to summarise it.
Microsoft and LinkedIn’s 2024 Work Trend Index reported that 72% of Indian AI users were already bringing their own AI tools to work. Most policies predate that behaviour, and the acceptable use policy ISO 27001 assessors see today needs a position on it.
A.5.10 does not mandate an AI section. Risk does. Name the approved tools. State what data may never go into any external model. Explain how someone requests approval for a new one.
Conclusion
An acceptable use policy ISO 27001 will pass on might not be the longest one. It is the one your team can recall under a direct question. Keep it short, keep it specific and make sure acknowledgement records exist before the auditor asks. The India sections separate a generic download from one that can actually hold up. A documented monitoring basis, CERT-In reporting duties and a clear AI position are easy to add, but none arrive by default.
At CyberNX, our ISO 27001 consulting services help teams build an acceptable use policy ISO 27001 auditors accept, mapped to Annex A 5.10 and aligned with Indian regulatory requirements. Talk to our experts and get your acceptable use policy audit-ready.
Acceptable use policy ISO 27001 FAQs
What is the acceptable use policy under ISO 27001?
It is the set of rules for using and handling company information and other associated assets. It maps to Annex A 5.10 and applies to everyone with access, including contractors and relevant third parties. The control says identify, document and implement, so an unread policy is not implemented.
Is an acceptable use policy mandatory for ISO 27001 certification?
ISO 27001 prescribes no standalone document with that title. But if A.5.10 sits in your Statement of Applicability, the rules must be identified, documented and implemented. They may live in one policy or across several. A single acceptable use policy ISO 27001 assessors can inspect is the easiest way to show it.
What changed in the acceptable use of assets policy ISO 27001 requires since 2013?
In ISO 27001:2013 these sat under separate controls, including A.8.1.3 and A.8.2.3. The 2022 edition brings acceptable use and handling together under A.5.10, whose guidance also covers authorised disposal and deletion methods. A.8.10 covers information deletion separately. Older documents miss the handling and disposal parts.
How often should the policy be reviewed?
A.5.10 sets no frequency. Review at the planned intervals your ISMS governance defines, and whenever something real changes. New SaaS platforms, BYOD, a new AI tool, an incident or a regulatory shift are all triggers. Annual works as a baseline. Auditors check the review date and version history, so three years untouched invites questions.
