Acceptable Use Policy

Current version

v3 (Attestation open)

Effective

Apr 16, 2026

Next review

Apr 16, 2027

Expires

Apr 16, 2027 (in 335d)

AI summary

AI summary: Acceptable Use Policy v3 — covers it acceptable use with updates to previous version. Recommended attestation cycle: annual.

Attestation coverage

82 / 92 (89%)

Assignment audiences

All employees

# Acceptable Use Policy

## 1. Purpose

This Acceptable Use Policy (AUP) defines the acceptable use of Northstar Logistics Holdings information systems, networks, and information resources by all employees, contractors, and temporary staff. It supports the company's commitment to information security, regulatory compliance (SOC 2 Type II, ISO 27001:2022), and operational integrity across our distribution network in Dallas, Long Beach, Newark, Rotterdam, and Hamburg.

## 2. Scope

This policy applies to all Northstar employees, contractors, vendors with system access, all company-issued laptops, mobile devices, vehicle telematics terminals, all software and cloud services (Microsoft 365, Salesforce, our internal WMS), and personal devices used to access Northstar information (BYOD).

## 3. Acceptable use

Authorized users may access information systems for legitimate business purposes, communicate with customers, partners, and colleagues via approved channels, install software from the corporate software catalog, and connect to corporate networks via approved VPN.

## 4. Prohibited use

The following activities are strictly prohibited: unauthorized access to systems, data, or accounts; sharing of credentials or multi-factor authentication tokens; storage of customer PII on personal devices; use of consumer cloud storage (personal Dropbox, Google Drive) for company data; installation of unapproved software, browser extensions, or VPN tools.

## 5. Device encryption (SUBSTANTIVE CHANGE — added in v3)

All endpoint devices accessing Northstar information must have full-disk encryption enabled (FileVault on macOS, BitLocker on Windows). Mobile devices must use device-level encryption with a passcode of at least 6 digits or a strong biometric. Loss or theft of an unencrypted device storing company data must be reported within 1 hour to security@northstarlogistics.com. This is a substantive change from v2 and triggers re-attestation for all assigned employees.

## 6. Enforcement

Violations may result in disciplinary action up to and including termination of employment, contractor agreement, or vendor relationship. Repeated or severe violations may be reported to law enforcement.

## 7. Review cadence

This policy is reviewed annually by Information Security, with substantive updates triggering an immediate re-attestation cycle.

## 8. Approver chain

Author: Marcus Sterling · SME reviewer: Aisha Patel · Compliance reviewer: Diego Ortega · Executive approver: Hank Mendez.

• Substantive

  v2 → v3Apr 15, 2026

  New device encryption obligation introduced in v3. AI substantive-change detector flagged this on save. Triggered re-attestation of all 92 prior attestations.