What does AUP stand for?
AUP stands for Acceptable Use Policy. The policy users accept that states what they may and may not do with company systems, networks and data.
An acceptable use policy is the document that tells users what they may and may not do with the organization's computers, network, email and data. Typical points are business use, no unapproved software, no sharing of passwords, how much personal use is tolerated, and that activity may be monitored. Users normally accept it before they receive an account, and again when it changes. That acknowledgement matters, because it lets the organization show that a person knew the rules. NIST's control catalogue covers the same idea as rules of behavior (control PL-4).
AUP in practice: an example
A new employee receives a laptop on her first day. Before the account is activated she reads and signs the acceptable use policy, which says, among other things, that company data may not be stored on personal cloud accounts. Six months later she uploads a customer file to a private drive. The signed policy is what makes the follow-up a clear disciplinary matter and not a misunderstanding.
What AUP is confused with
AUP vs NDA: what is the difference?
An NDA is a contract about keeping specific information confidential, often signed with outsiders. An AUP is an internal policy about how the organization's systems may be used. What NDA stands for
AUP vs EULA: what is the difference?
A EULA is the licence a software vendor attaches to its product. An AUP is the organization's own set of rules for its users, whatever software they run.
Which exams cover AUP?
AUP is on the official CompTIA acronym list for three of the four exams covered here.
- Security+ SY0-801: 5.1 (Security Program Management and Oversight).
- Network+ N10-009: on the acronym list, not tied to one objective.
- A+ 220-1201 and 220-1202: 220-1202 4.0 (Operational Procedures).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Which document tells employees that company email may not be used to run a private business?
- The acceptable use policy
- The service-level agreement
- The disaster recovery plan
- The network diagram
Show the answer
A. The acceptable use policy. Rules for how staff may use company systems belong in the AUP. An SLA sets service targets and a recovery plan describes how to restore systems.
2. Why do organizations make users sign or click to accept the AUP?
- To have a record that the user knew the rules
- To encrypt the user's mailbox
- To assign the user an IP address
- To increase the password length
Show the answer
A. To have a record that the user knew the rules. The acknowledgement is evidence that the user was informed, which the organization needs in order to enforce the policy. It has no technical effect on the account.
Sources: NIST SP 800-53 Rev. 5, Security and Privacy Controls (PL-4, Rules of Behavior); NIST glossary: acceptable use agreement. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 12 November 2026.