Equipment and IT security policy template for a handbook: free
Also known as: Acceptable use policy template, IT equipment policy template, Device and security policy, Company equipment policy template
A free equipment and security section for an employee handbook. It covers company laptops and phones, personal devices, passwords and access, acceptable use, handling of confidential data, reporting a loss or incident and returning equipment when employment ends.
Most data leaks and equipment losses come from ordinary mistakes: a lost laptop, a reused password, a file sent to the wrong person. A short, specific policy tells people what they must do and what they must not do, and it tells the company what it can ask for when something goes wrong or when someone leaves. This section is written for small and medium companies. It sets the rules that matter and points to your detailed IT and data protection documents for the rest.
SECTION HEADER
[COMPANY LEGAL NAME] Equipment and Security Version: [1.0] Effective date: [YYYY-MM-DD] Applies to: [ALL EMPLOYEES, CONTRACTORS AND INTERNS WHO USE COMPANY SYSTEMS] Owner: [IT / SECURITY LEAD / ROLE]
1. COMPANY EQUIPMENT
The company provides the equipment you need for your work, for example [LAPTOP, PHONE, MONITOR, ACCESS CARD]. This equipment stays the property of [COMPANY NAME]. You are responsible for taking reasonable care of it. Do not install software that is not approved by [IT CONTACT], and do not lend company equipment to other people, including family members. [Limited personal use of company equipment is allowed if it does not interfere with your work and does not break this policy. / Company equipment is for work use only.]
2. PERSONAL DEVICES
[OPTION A: You may not use personal devices for work.] [OPTION B: You may use a personal phone or computer for [E-MAIL AND CHAT ONLY / THE APPLICATIONS LISTED BY IT] if it has a screen lock, current operating system updates and [MOBILE DEVICE MANAGEMENT SOFTWARE]. Do not store company files on personal devices outside the approved applications. The company may remove company data from your device if you lose it or leave the company.]
3. PASSWORDS AND ACCESS
- Use a unique password for every system. Use the company password manager: [NAME / LINK]. - Turn on two-step verification wherever it is available. - Never share your password or approve a login that you did not start. - Lock your screen when you leave your device, even at home. - You get only the access your job needs. Ask [IT CONTACT] if you need more, and tell [IT CONTACT] when you no longer need access you have.
4. ACCEPTABLE USE
Do not use company equipment or accounts to: - break the law or the company's Code of Conduct; - access, store or send illegal, offensive or discriminatory material; - run a business of your own or work for another employer, unless allowed in writing; - bypass security controls, or install tools meant to do so; - send confidential data to personal accounts or unapproved services. Be careful with e-mail links and attachments. If something looks wrong, do not click it and report it to [SECURITY CONTACT].
5. CONFIDENTIAL DATA AND PERSONAL DATA
Keep company, customer and employee data in approved systems: [LIST OF APPROVED SYSTEMS]. Do not copy data to USB drives, personal cloud storage or personal messaging apps. Share data only with people who need it for their work. Follow [LINK TO DATA PROTECTION POLICY] for personal data. Do not discuss confidential matters in public places or on public networks without a secure connection.
6. LOSS, THEFT AND INCIDENTS
If a device is lost or stolen, or you think an account or data has been exposed, report it to [SECURITY CONTACT / E-MAIL / PHONE] immediately, and no later than [NUMBER] hours after you notice. Report quickly, even if you are not sure. You will not be blamed for reporting honestly. Delays make incidents worse, and some incidents must be reported to authorities within a short deadline that starts when the company becomes aware.
7. MONITORING
[OPTION A: The company does not monitor the content of your communications. It does keep security logs of access to systems and devices for the purpose of protecting company data.] [OPTION B: The company monitors [SPECIFY: COMPANY E-MAIL, WEB ACCESS, DEVICE USE] for [SPECIFY PURPOSE, FOR EXAMPLE SECURITY AND COMPLIANCE]. Monitoring is limited to what is necessary, follows local law and is described in [LINK TO PRIVACY NOTICE FOR EMPLOYEES].]
8. RETURN OF EQUIPMENT
When your employment ends, or earlier if we ask, return all company equipment and data by [LAST WORKING DAY / DATE] to [NAME / TEAM]. Your accounts are closed on your last working day [AT TIME]. Remove personal files from company devices before you return them. Equipment that is not returned or is returned damaged beyond normal wear may be charged to you where the law allows.
9. CONSEQUENCES
Breaking this policy can lead to [A WARNING, LOSS OF ACCESS, DISCIPLINARY ACTION UP TO DISMISSAL] as described in the Code of Conduct. I have read and understood this policy. Name: [EMPLOYEE FULL NAME] Signature: _________________ Date: [YYYY-MM-DD]
When to use this template
- You give laptops, phones or other devices to employees
- Employees use personal phones or computers for work
- You need a written basis for asking for equipment back when someone leaves
The rules that do most of the work
- Unique passwords and a password manager, with a second factor wherever it is offered
- Screen lock and disk encryption on every device that holds company data
- Company data stays in approved systems, not in personal accounts or messaging apps
- Lost or stolen devices and suspected incidents are reported at once, without blame for the person who reports
- Equipment is returned, and access is removed, on the last working day
Customization notes
Section 1: say whether personal use is allowed. A flat ban that everyone ignores is worse than a clear, limited allowance. Section 2: choose option A or B. If you choose B, make sure you can actually enforce the conditions, for example with device management. Section 6: set a reporting window that people can meet, and say that reporting is never punished. Fear of blame is the main reason incidents are hidden. Section 7: involve your data protection adviser before you choose option B. Monitoring is regulated in many countries and often needs notice or consultation. Section 8: a deduction from final pay for unreturned equipment is restricted or banned in some countries. Check the local rule before you keep the last sentence. Keep the technical details, such as encryption standards and password length, in the IT document. The handbook should stay readable.
Frequently asked questions
What should an equipment and security policy include?
Ownership and care of company equipment, rules for personal devices, passwords and access, acceptable use, handling of confidential data, how to report a loss or incident, monitoring, and the return of equipment when employment ends.
Can employees use personal devices for work?
Many companies allow it with conditions such as a screen lock, updates and the ability to remove company data. Others forbid it. Whichever you choose, state it in writing and make sure you can enforce it.
Can we deduct unreturned equipment from final pay?
Only if the law and the contract allow it. Some countries restrict or prohibit deductions from wages. Check the local rule and, if in doubt, ask for the equipment back and pursue the value separately.
Do we have to tell employees if we monitor them?
In many countries yes, and sometimes you also need to consult employee representatives or carry out a data protection assessment. Describe the monitoring and its purpose in a privacy notice for employees.