[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-10":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-10","Annex A 5.10","Acceptable use of information and other associated assets",0,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Define, document and put into effect rules for how people may use information and the assets that store or process it, along with procedures for handling that information safely.\n\n**In practice.** A good acceptable use policy is short, written for staff rather than lawyers, and covers email, internet, cloud services, personal devices, generative AI tools and the handling of each classification level. Staff and contractors acknowledge it at onboarding and after material changes, and handling rules map to the classification scheme so people know what they may share, print or store where. Auditors expect the approved policy, signed or recorded acknowledgements, and some sign that breaches are detected and acted on.\n\n**Common gaps.** Policies are often generic templates that predate cloud collaboration and AI tools, so they say nothing about where people actually work. Acknowledgement is frequently a one-off tick box with no refresh and no link to classification-specific handling rules.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]