What should an acceptable use policy say about security monitoring?
It should say plainly that company devices and networks are monitored for security, what that means and where the limits are. A useful section covers: the purpose (detecting attacks and protecting data, not measuring performance); what is recorded (connection metadata from company devices and networks, not message content); whether private use of company devices is allowed and how private traffic is treated; rules on personal devices, USB storage, remote-access tools and AI services; who sees alerts and how long records are kept; what happens when an alert involves an employee's device; and whom to ask. Keep it short enough to be read, have it reviewed by legal advice and, where required, agreed with employee representatives. Describe NetSenX by what it does: device and connection monitoring, without decryption.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- How long should security logs about employee devices be kept?
- Is AI-based emotion or productivity monitoring of staff allowed in the EU?
- How do we know a former employee's device is no longer on our network?
- What should IT check on the network when an employee leaves?
- Can we see when an unreturned company laptop connects again?