Audit evidence packet

# Acceptable Use Policy

## 1. Purpose

This Acceptable Use Policy (AUP) defines the acceptable use of Northstar Logistics Holdings information systems, networks, and information resources by all employees, contractors, and temporary staff. It supports the company's commitment to information security, regulatory compliance (SOC 2 Type II, ISO 27001:2022), and operational integrity across our distribution network in Dallas, Long Beach, Newark, Rotterdam, and Hamburg.

## 2. Scope

This policy applies to all Northstar employees, contractors, vendors with system access, all company-issued laptops, mobile devices, vehicle telematics terminals, all software and cloud services (Microsoft 365, Salesforce, our internal WMS), and personal devices used to access Northstar information (BYOD).

## 3. Acceptable use

Authorized users may access information systems for legitimate business purposes, communicate with customers, partners, and colleagues via approved channels, install software from the corporate software catalog, and connect to corporate networks via approved VPN.

## 4. Prohibited use

The following activities are strictly prohibited: unauthorized access to systems, data, or accounts; sharing of credentials or multi-factor authentication tokens; storage of customer PII on personal devices; use of consumer cloud storage (personal Dropbox, Google Drive) for company data; installation of unapproved software, browser extensions, or VPN tools.

## 5. Device encryption (SUBSTANTIVE CHANGE — added in v3)

All endpoint devices accessing Northstar information must have full-disk encryption enabled (FileVault on macOS, BitLocker on Windows). Mobile devices must use device-level encryption with a passcode of at least 6 digits or a strong biometric. Loss or theft of an unencrypted device storing company data must be reported within 1 hour to security@northstarlogistics.com. This is a substantive change from v2 and triggers re-attestation for all assigned employees.

## 6. Enforcement

Violations may result in disciplinary action up to and including termination of employment, contractor agreement, or vendor relationship. Repeated or severe violations may be reported to law enforcement.

## 7. Review cadence

This policy is reviewed annually by Information Security, with substantive updates triggering an immediate re-attestation cycle.

## 8. Approver chain

Author: Marcus Sterling · SME reviewer: Aisha Patel · Compliance reviewer: Diego Ortega · Executive approver: Hank Mendez.