IT charter template: the rules everyone signs
A plain-language IT charter, also called an acceptable use policy, for a small or mid-sized company. Copy it, keep what matches your company, delete the rest. Free, no sign-up.
Before you use it
- Replace every [bracket] with your company’s reality, and delete the sections that don’t fit. A rule nobody follows weakens all the others.
- Each rule is true today, or decided with a date. “From 1 December, email sign-in will ask for a second factor” beats an ideal copied from somewhere.
- Describe only the monitoring that really exists (remote support tools, web filtering, logs), and tell employees before any data is collected.
- Check your labour law before relying on the charter for a sanction. Employees in France: use the French version, which sets out the adoption procedure.
The template
IT charter of [Company]
1. Purpose and scope. This charter sets the rules for using [Company]’s IT and the security measures in place, to protect our customers’ data and keep the business running. It applies to everyone who uses our IT: employees, apprentices, interns and contractors with an account. It covers computers, accounts, email, the network, software ([Microsoft 365 / Google Workspace], [business software]) and phones used for work.
2. Your accounts and passwords. Every account is personal. Never share your password, not even with a colleague or a manager. Use a different password for each service, [saved in the password manager provided]. Signing in to [email] asks for a second factor (a code on your phone or a key) [since / from] [date].
3. Your computer and devices. Lock your screen when you step away. Don’t install software without [name or IT provider]’s approval. Accept updates when they’re offered. Report a lost or stolen laptop or phone to [name], on [phone], straight away.
4. Email, phishing and payments. An unexpected email asking you to click, type a password or pay is suspicious, even if it seems to come from a colleague or a customer. Forward it to [address or name] without clicking. Never change a supplier’s or customer’s bank details because of an email: call them back on a number you already know.
5. Customer data and documents. Work documents are saved on [server, SharePoint, Drive]. They are not kept in personal email, on personal USB drives or in personal online services. To send large files, use [approved tool].
6. Internet and personal use. Reasonable personal use of email and the internet is fine, as long as it doesn’t get in the way of work and stays within the law. Illegal content is forbidden.
7. AI tools. Don’t put customer data, employee data or confidential information into an AI tool [Company] hasn’t approved. Approved tools: [list].
8. Remote work. Remote access goes only through [VPN, Microsoft 365 with a second factor]. On public Wi-Fi, [use your phone’s hotspot / the VPN].
9. What the company does: administration and monitoring. [Keep only what exists.] Our IT provider [name] can take remote control of your computer to help you, with your consent at each session. [Web traffic is filtered to block malicious sites; logs are kept for [period].] These measures protect the security and smooth running of our IT. You can exercise your rights over your data with [contact].
10. Reporting an incident. Report any incident or doubt (a suspicious email, a lost phone, an unusual message, files that suddenly can’t be opened) to [name], on [phone], straight away. Don’t try to fix it alone. A false alarm is better than silence.
11. Leaving the company. When you leave, you return the equipment you were given. Your accounts are closed on [your last day]. You keep no copy of company data.
12. Adoption and review. Approved by [name, role] on [date]. In force from [date]. Next review: [date].
What QoBot adds
QoBot starts from this template, asks the questions that decide how to adopt it, and writes a charter that contains only rules that are true in your company, with your tools and your contacts. It then creates one action per formality: signature, staff representatives if needed, informing every employee.
Tailoring the charter: who does what
What QoBot does
- Asks the questions that decide how to adopt it: headcount, internal rules, staff representatives, monitoring actually in place, who signs.
- Keeps only the rules that are true in your company today, or decided with a date.
- Names your tools and your people: Microsoft 365, your business software, your IT provider.
- Creates one action per formality, with an owner.
What your team does
- Answer the questions and choose the rules.
- Have management sign the charter.
- Complete the formalities and inform every employee.
Fenwick Accounting's charter is ready: 10 sections kept, 2 removed because they don't match your company. Before it applies:
- You: review and sign charter v1 · ~15 minNeeds you
- Nadia (office manager): send it to the 14 employees with the acknowledgement email · email drafted · ~10 minYour turn
FAQ
Is an IT charter mandatory?
No law requires one as such. What labour law usually regulates is the documents that set disciplinary rules for employees and the monitoring of their activity. A charter that does either must follow those rules in your country.
We employ people in France. Anything special?
Yes. The charter must be in French, and if it carries disciplinary rules it's annexed to the internal rules and follows their procedure. Use the French version of this template, which explains the steps.
Is a signature enough to enforce it?
A signature proves the employee was informed. Whether you can sanction someone on the basis of the charter depends on your labour law: check with a labour lawyer before relying on it.
Can we use this template for free?
Yes. Copy it, adapt it, use it in your company.
Sources
- French Labour Code, article L1321-6Documents setting obligations for employees are written in French (France)Official text
- French Labour Code, article L1321-5Documents that add to the internal rules (France)Official text
- Regulation (EU) 2016/679 (GDPR), article 32EUR-Lex · security of processing, including staff awarenessOfficial text
This page explains the rules in plain words. It isn't legal advice: for a borderline case, ask a lawyer. Report an error