Acceptable Use & IT Policy

1 · Purpose

This policy sets out how Nxt7a's IT systems, devices, accounts and data may and may not be used, so that they remain secure, lawful and available for legitimate business.

2 · Scope

Applies to all users of Nxt7a systems – staff, contractors and authorised third parties – and to all devices used for work, whether company-provided or personal (BYOD), anywhere in the world.

3 · Policy Statements

Acceptable use. Nxt7a systems are provided for business purposes. Limited, reasonable personal use is permitted provided it is lawful, does not interfere with work, and does not breach this or other policies.

Prohibited use. Do not use Nxt7a systems to: break the law; harass, discriminate or bully; access or distribute illegal or offensive material; infringe intellectual property; bypass security controls; or run unauthorised businesses.

Accounts and authentication. Use your `@nxt7a.com` single sign-on where available. Protect credentials, use strong unique passwords stored in the approved password manager, and enable multi-factor authentication. Never share accounts or credentials.

Devices. Keep devices patched, encrypted and locked when unattended. Personal devices used for work must meet minimum security requirements. Report lost or stolen devices immediately.

Software and shadow IT. Install only approved software. Do not adopt new SaaS tools that handle company or client data without approval – the approved catalogue is the Core Systems page; request additions via Jira Service Management.

Email and communications. Be alert to phishing and social engineering. Do not send confidential information to unauthorised recipients. Treat Slack, email and documents as business records.

AI tools. Use of Claude, Gemini, ChatGPT and other AI systems is governed additionally by the AI Use Guidelines – in particular, do not paste confidential, personal or Indigenous community data into AI tools except as those guidelines permit.

Monitoring. Nxt7a may monitor and log system use for security, legal and operational reasons, proportionately and consistent with privacy obligations.

4 · Roles & Responsibilities

• Users use systems responsibly and report issues.
• Information Security Officer maintains the approved tool catalogue and security baselines.
• Managers ensure their teams understand acceptable use.

5 · Compliance, Monitoring & Breach

Breaches may result in withdrawal of access and disciplinary action under the Code of Conduct, and referral to authorities where the law is broken.

6 · Related Documents

Information Security Policy · Access Control Policy · Data Classification & Retention Policy · AI Use Guidelines · Employee Handbook.

7 · Standards Mapping

• B Corp: Workers.
• ISO/IEC 27001:2022: A.5.10 (acceptable use of information); A.8 (technological controls – endpoints, malware, configuration).
• ISO/IEC 42001:2023: A.9 (responsible use of AI systems).

8 · Version History