Page 396 - CyberSecurityEssentialsEnglish

TABLE 8-17: A SHORT POLICY TEMPLATE

Section What it states

Purpose and scope Why the policy exists, and who and what it covers.

Permitted uses Examples that may proceed under standing rules.

Restricted uses What requires registration, review, or approval first.

Prohibited uses What may not be done, and why.

Data rules Which data may be entered, and into which approved channels.

Review and
What must be checked before use, and what must be declared.
disclosure

Exceptions How to request one, who approves, and for how long.

What counts as an incident, and how to report it without
Incidents
penalty.

Ownership and
Who owns this policy, and when it is next reviewed.
review

Second: A Register of AI Uses
The register records the uses that deserve institutional visibility, not every small personal

experiment. It should preferably cover medium and high uses, tools integrated into
processes, agents, and systems using non-public data. The register becomes a source for
knowing where value, risk, and duplication lie, and it prevents systems from disappearing

when staff move on.

395