It is a document that outlines what employees can and cannot do when using unauthorized applications and services. The policy should be created with the input of both IT and business managers.