A document defining the acceptable ways employees and users can use organizational IT resources, establishing boundaries and consequences for violations.