Which policy governs the acceptable use of Piedmont's information systems and devices?

• A. Data Protection Policy
• B. IT Security Policy
• C. Acceptable Use Policy (AUP) for technology and data
• D. Confidentiality Policy

Answer: (C)

Rules for how people should use Piedmont’s information systems and devices are set out in the Acceptable Use Policy for technology and data. This policy spells out what activities are allowed, what isn’t, and what responsibilities users have—like keeping passwords secure, not sharing accounts, and reporting incidents. It directly addresses day-to-day use of hardware, software, networks, and data resources, because it defines the boundaries of acceptable behavior and potential consequences for violations.

Other policies cover related but broader areas. The Data Protection Policy focuses on safeguarding personal data and privacy obligations, not the everyday rules for using technology. The IT Security Policy outlines security controls, risk management, access control, and incident response. The Confidentiality Policy is about preserving confidential information and non-disclosure requirements. While all are important for overall security and governance, the policy that most precisely governs how technology and data may be used is the Acceptable Use Policy.