1. The top risks and threats of the user domain are Users and social engineering.
2. Most Organization uses AUP because it defines the intended use of computers and networks, including unacceptable uses and the consequences for violation of policy.
3. Internet and emails can be covered in an organization’s AUP for example what sites users can visit from a work station.
4. Both HIPPA and GLBA play roles In an organization AUP, for example with GLBA its mandatory to notify regulators promptly of any unauthorized access to customers financial records and say a employee just wondered into the account out of curiosity if there was a AUP implemented this shouldn’t have happened.
5. An AUP is not a failsafe means of mitigating risks and threats within the user domain because there is a great possibly of the users still doing something wrong that was pointed out in an AUP it’s hard to gauge what a human might do.
6. An AUP should be applied to all levels of an organization because it shouldn’t matter if you’re a new employer or a head branch manager no one should be on porn sites at work.
7. This policy should be in effect from day 1 of operation and periodically needs to be audited for weaknesses and vulnerabilities.
8. An organization might want to align its policies with existing compliance requiremnets because they might deal with hundreds of laws so to make it easier on the orginzation they make some of the laws of HIPAA or PCI DSS as some of the organization’s