An acceptable use policy (AUP) primarily defines:

1. AHow auditors sample transactions for testing
2. BHow users may and may not use organizational systems and data
3. CHow backups are rotated and stored offsite
4. DHow firewalls must be configured for internet access