Make sure the policy development team has been very thorough in defining what employees can and cannot do. The team should consider all internal areas, not just Internet access. For example, if only HR employees can access the payroll system, this should be defined in the Acceptable Use policy. Policies also need to be reviewed on a periodic basis to ensure they are still representative of what is in place. Most companies review their security policies on an annual basis and update the information as necessary.
Policies often become a political battle within a company.
Employees feel security policies impede their ability to perform their job duties and allow the company to monitor their every move. Making users a part of the policy development process goes a long way towards curbing this hostility. In addition, management must advocate and practice the security policies implemented by the company in order for them to be enforceable. Always practice what you preach. The policy scope is a brief statement describing who is covered by the policy.