Cyber Security Policy

Rules for people who use Mesabi Outfitters technology and information. Clear expectations beat fine print—protect the business, report problems early, and use systems for work.

Version 2026.1 Last reviewed: 2026-03-12 IT North help: 218-256-4249

Why this exists. It tells employees and contractors what “good” looks like, what is off-limits, and how to raise a hand when something feels wrong—phishing, lost devices, or odd access requests.

1. What we protect

Everyone with access helps protect:

Computers, laptops, servers, phones, and network gear
Email, files, cloud apps (including Microsoft 365), and line-of-business software
Passwords, MFA devices, and any confidential business or customer data
Backups and recovery systems that keep the company running after an outage

2. Information classification

Treat company data as either confidential or business-use:

Confidential — customer data, financials, HR, passwords, unique process knowledge. Share only with people who need it for their job. Do not send to personal email or unapproved cloud apps.
Business-use — day-to-day operational information that is not public marketing. Keep it inside approved company systems.

When unsure, treat the data as confidential and ask a manager or IT North.

3. System sensitivity

Level	Meaning	Examples
Critical	Holds confidential data or runs mission-critical services. Failure hurts operations or finances.	File/domain servers, ERP, firewalls, backup appliances
Standard	Day-to-day PCs and accounts used to reach Critical systems.	Staff laptops, office workstations
Public	Externally reachable systems with no confidential data (if used).	Public website

4. Threats to keep in mind

People on the inside — mistakes or misuse; limit access to the job and remove it when roles change.
Opportunistic attackers — scan for unpatched mail, web, or remote access holes.
Targeted attacks — less common, but plan for phishing and ransomware that aim at businesses like yours.

5. Acceptable use

Use company systems for company business. Limited personal use is fine if it does not risk data, bandwidth, or reputation.
Do not share logins. Every person gets their own account.
Do not install unapproved software or attach unknown USB devices.
Do not bypass MFA, VPN, email filters, or endpoint protection.
Do not send confidential data to personal email or unapproved cloud storage.
Do not harass others, degrade systems, or try to access systems you were not given.

6. Internet, email, and messaging

Internet and email are business tools. Do not use them to harass, discriminate, trade illegal content, or run side businesses on company systems. Treat unexpected payment, gift-card, or “reset payroll” messages as suspicious— verify out-of-band before clicking.

7. Access control & passwords

Access is granted for the job—and removed when the job changes or ends.
Use unique, strong passwords (or a company-approved password manager). Never share passwords with coworkers or managers.
MFA is required wherever IT North has enabled it.
Managers must tell IT North promptly when someone leaves, is suspended, or changes roles so accounts can be adjusted the same day when possible.
Forgotten passwords go through IT North identity checks—never through an unexpected email link.

8. Devices, remote access & third parties

Keep laptops with you or locked; report loss or theft the same day.
Do not disable updates, antivirus/EDR, or disk encryption.
Personal devices may access company email/files only if IT North has approved the method.
Remote access to the company network uses IT North–approved secure methods (typically VPN + MFA). Do not install personal remote-control software on company PCs.
Third-party or vendor network links need written approval and must not bridge the public Internet into the company LAN.
Do not attach hubs, unknown storage, or other devices that change the network without approval.

9. Reporting incidents

Report immediately (ticket in the IT North portal, or call 218-256-4249):

Suspected phishing or malware
Unexpected password prompts or locked accounts
Lost/stolen devices
Anyone asking you to share credentials or bypass security
Illegal access, ransomware symptoms, or systems behaving oddly after a click

If you think a device is compromised: leave it powered on if safe to do so, do not wipe files, and contact IT North so evidence and recovery options are preserved.

Early reporting limits damage. You will not be punished for reporting a genuine mistake quickly.

10. Monitoring

Mesabi Outfitters and IT North may review system logs, email filtering events, and device health as needed to protect the business and investigate incidents. Continuous personal surveillance is not the goal— security and reliability are.

11. Roles

Role	Responsibility
Employees & contractors	Follow this policy; protect credentials; report issues; complete acknowledgements when asked.
Company leadership	Approve policy; support offboarding; fund required controls; decide on serious incidents.
IT North (security administrator)	Advise on controls, monitor managed systems, help investigate incidents, keep Continuity docs and evidence current.

12. Violations

Misuse can lead to loss of access and employment action under Mesabi Outfitters policies, and may involve law enforcement when required. IT North will assist leadership with technical facts.

13. Review

This policy is reviewed at least annually (or after a major incident or system change). Current version and acknowledgements live in the IT North portal under Continuity.

Prepared with IT North (Hibbing, MN). This document is company-specific guidance for systems IT North helps manage. It does not create insurance coverage or guarantee zero downtime.