Acceptable Use of Technology Policy and Procedures

[Applicable to all actors]
1. Define and Document Policies: Develop clear acceptable use guidelines covering permissible data inputs and outputs, training sets, algorithmic operations, and deployment practices. Incorporate ethical principles (fairness, transparency, bias prevention) and comply with relevant legal and regulatory requirements.

2. Align with External Provider Requirements: Integrate AI service provider policies into internal acceptable use standards, ensuring consistent rules for data handling, model usage, and system integration.

3. Communicate and Train: Communicate policies to all teams and stakeholders. Provide regular training on safe and appropriate AI use, data handling practices, and potential risk mitigation strategies.

4. Oversight and Monitoring: Assign compliance oversight responsibilities and deploy monitoring tools (e.g., usage logs, anomaly detection) to ensure adherence to acceptable use guidelines.

5. Periodic Review and Update: Review and update acceptable use policies at least annually, or when significant changes occur in technology or regulation. Gather input from stakeholders to refine and improve policy scope.

1. Policy Establishment and Documentation: Verify that the CSP has established and documented two distinct AUPs, an internal AUP for employees and contractors, addressing acceptable and prohibited use of customer environments and data, and a published AUP for customers, defining acceptable and prohibited use of CSP services and infrastructure by tenants.

2. Policy Communication and Acknowledgement: Confirm that the internal AUP is communicated to all CSP employees and contractors, with signed acknowledgements retained. Verify that the customer‑facing AUP is published and easily accessible to all customers (e.g., through terms of service, portal links).

3. Content of the Internal AUP: Verify that the internal AUP explicitly prohibits unauthorized access to or use of customer environments, data, or resources; unauthorized changes to customer configurations or services; and disclosure of sensitive customer information. Confirm the AUP defines consequences for violations and outlines escalation and reporting procedures.

4. Content of the Customer‑Facing AUP: Verify that the customer‑facing AUP explicitly prohibits use of CSP services for illegal or prohibited activities, abuse of resources (e.g., unauthorized crypto‑mining, spamming, denial‑of‑service attacks), and launching attacks or unauthorized access attempts originating from the customer’s tenancy. Confirm the AUP clearly defines enforcement actions (e.g., suspension or termination of services for violations).

5. Monitoring and Enforcement: Verify that monitoring mechanisms are in place to detect violations of both the internal and customer‑facing AUPs. Ensure that documented procedures exist to investigate violations, notify relevant parties, and apply corrective actions.

6. Periodic Review and Maintenance: Confirm that both the internal and customer‑facing AUPs are reviewed and updated at least annually, or after significant changes to services, laws, or customer expectations. Verify that evidence of review and approval is maintained.

From CCM:
1. Examine policy for adequacy, currency, communication, and effectiveness.
2. Verify that a definition of organizationally-owned or managed assets exists, and is implemented.
3. Verify, through interviews or otherwise, that the policy is communicated to users.
4. Examine policy and procedures for evidence of review at least annually.