At Paul, Hastings, Janofsky & Walker, a law firm headquartered in Los Angeles with more than 1,900 employees, staffers must sign a technology usage agreement upon joining the firm. CIO Mary Odson also circulates an update or review of the agreement every six months.

The cornerstone of the e-mail usage policy is the definition of proper e-mail use. By now it should be clear that employees in the United States do not have an expectation of privacy in their company e-mail accounts (though it does not hurt to spell that out prominently in the policy). The question that remains is whether employees may use the e-mail system to send personal messages. Allegiance Telecom’s policy is restrictive: Employees must confine their e-mail to business purposes only. "They should not e-mail their mother," Naramore says. He adds that IT staff do not police employees’ e-mail messages unless they see a vast increase in messages or other curious activity. "This doesn’t come up unless there’s a productivity issue," he says.

Other companies are more lenient. "They’re welcome to e-mail or surf the Web during lunch or while taking a break," says Mike Foster, CEO of Foster Institute, a technology training company in Dallas. Still others do not restrict their employees’ e-mail or Internet usage, believing that free use is a perk to be enjoyed by all salaried employees in good standing who get their work done.

Ray Everett-Church, senior privacy strategist for consultancy ePrivacy Group in Malvern, Pa., believes that the most restrictive policies treat employees as children, leading to poor morale, low productivity and an atmosphere of distrust. As a privacy advocate, he strongly advises CIOs not to have a policy of reading employees’ e-mail. On the other hand, he says employees should be notified that the network is a company resource and that particular practices (such as downloading MP3 files or sending messages with sexual or discriminatory content) are forbidden. "Reserve the right to access e-mail, but at the same time make it clear the employees are valued and trusted," Everett-Church says.

Executives interviewed for this article echo a key fact of life: Policy violations will still happen. The best usage policy in the world will not prevent all misuse. After all, as Foster says, "If it weren’t for people, this stuff would be easy." When a breach has occurred—and they will happen—the most important thing you can do is take action. Whether the offense involved defamation, sexual harassment or disclosure of corporate secrets, you must consult with legal counsel and then meet with the offender. Don’t get into the meeting without a rep from HR.