IT & Cybersecurity Policy

WHAT YOU MUST DO

✔ Use our approved password manager for all passwords.
Store every work login in our approved password manager. Use it to generate strong, unique passwords. Never reuse passwords.

✔ Lock your screen every time you step away.
Lock your screen manually whenever you step away. Systems auto-lock after a period of inactivity – don’t wait for it.

✔ Use MFA wherever it is available.
Multi-factor authentication is required for all systems that support it.

✔ Report anything suspicious immediately.
Phishing email, strange pop-up, lost/stolen device, or unauthorized access – report to your supervisor and IT immediately.

✔ Be cautious on public Wi-Fi.
Only use trusted, secure Wi-Fi networks for work. If you are unsure whether a network is safe, use your personal hotspot instead.

✔ Keep devices updated and encrypted.
Apply updates promptly when prompted. All portable devices storing company data must be encrypted.

✔ Follow the clean desk rule.
Secure all documents containing sensitive data when you leave your desk. Nothing sensitive left out overnight.

✔ Stay current with security awareness.
Security and awareness training is ongoing—participate as new training lands in your inbox.

WHAT IS NOT ALLOWED

✘ Share your password.
No one at Northwest, including your manager, will ever ask for your password. If someone does, report it to IT immediately.

✘ Click links or open attachments you didn’t expect.
Phishing is our #1 threat. When in doubt, don’t click. Contact IT first. All suspicious emails must be reported.

✘ Install software, apps, or browser extensions without IT approval.
This includes remote access tools, games, toolbars, browser extensions, or anything downloaded from the internet.

✘ Use personal email or personal cloud storage for work data.
No personal email accounts, personal cloud storage, or unencrypted removable media for company data. Company data stays on company systems.

✘ Use a personal device for work without registering it with IT.
BYOD devices must be approved, registered, and configured by IT before accessing any company data.

✘ Build or deploy any work tool or app without sending it to IT first.
If you create or configure any tool, script, or app for work purposes – including anything built with AI – send it to IT for review before anyone uses it or it goes live anywhere. When in doubt, ask IT first.

✘ Dispose of or transfer any device without IT sign-off.
All hardware must go through the Technology Equipment Disposal process. Never donate, sell, or discard company equipment on your own.

✘ Access data beyond your role, or take company data when you leave.
Accessing files outside your job function may result in immediate termination. Upon departure all devices and data must be returned to IT the same day.