Acceptable Use Policy

4.1 General Use and Ownership

T3 Consulting technology resources are provided primarily for legitimate business, operational, project and customer-related activities.

• Users must use company systems and technology resources responsibly and securely.
• Access must be limited to authorized business purposes.
• Users must comply with applicable company policies, contractual obligations and legal requirements.
• Company systems, applications and information remain the property of T3 Consulting or the respective customer.
• Users must not use company resources in a way that disrupts operations or creates security risks.
• Personal use, where permitted, must be limited and must not interfere with business responsibilities.

Users should have no expectation that company-owned systems or business information are private where monitoring, review or access is required for legitimate security, administrative, operational or compliance purposes.

4.2 Security and Proprietary Information

Users are responsible for protecting T3 Consulting information, customer information, credentials and technology resources against unauthorized access, disclosure or misuse.

• Passwords and authentication credentials must not be shared.
• Users must use strong authentication practices where required.
• Confidential information must only be accessed by authorized individuals.
• Sensitive information must not be copied, transferred or disclosed without authorization.
• Access to customer systems must be limited to approved project requirements.
• Devices must be appropriately secured when left unattended.
• Security controls must not be disabled or bypassed without authorization.
• Suspected security incidents must be reported promptly.

4.3 Unacceptable Use

The following activities are prohibited unless specifically authorized as part of an approved business, security-testing or customer engagement.

• Unauthorized access to systems, networks, applications or information.
• Attempting to bypass authentication, permissions or security controls.
• Sharing passwords, accounts or authentication credentials.
• Using another person's account without authorization.
• Installing unauthorized software, tools or applications.
• Introducing malware, ransomware, viruses or other malicious code.
• Conducting unauthorized vulnerability scans or penetration tests.
• Intercepting or monitoring network traffic without authorization.
• Attempting to exploit vulnerabilities without approved authorization.
• Accessing customer environments outside the approved project scope.
• Copying customer data to unauthorized devices or storage locations.
• Uploading confidential information to unauthorized cloud services or AI tools.
• Disabling antivirus, endpoint protection, logging or other security controls.
• Using company resources for illegal, fraudulent or malicious activities.
• Using systems to harass, threaten, discriminate against or harm another person.
• Downloading or distributing unlawful, offensive or inappropriate content.
• Violating intellectual property, copyright, licensing or software usage restrictions.
• Sending spam, unsolicited bulk messages or unauthorized promotional communications.
• Creating unauthorized external accounts using company credentials.
• Using company systems for unauthorized commercial or personal business activities.
• Attempting to disrupt, overload or damage company or customer systems.
• Deleting, modifying or destroying business information without authorization.
• Using removable media or external storage contrary to applicable security requirements.

Use of Customer Systems & Data

T3 Consulting personnel may be provided access to customer applications, databases, cloud environments, networks or other technology resources as part of an approved engagement.

Users accessing customer environments must:

• Access only systems required for the assigned work.
• Follow customer security requirements where applicable.
• Use customer information only for authorized project purposes.
• Avoid unnecessary copying or downloading of customer data.
• Protect privileged credentials and administrative accounts.
• Immediately report suspected customer security incidents.
• Remove locally stored customer information when it is no longer required.

Internet & Web Usage

Internet access provided through T3 Consulting resources should primarily support legitimate business, research, customer and professional activities.

Users must not:

• Visit websites known to distribute malware or illegal content.
• Download unauthorized software or executable files.
• Bypass web filtering or security restrictions.
• Use unauthorized proxy, VPN or anonymization services to avoid security controls.
• Use company internet resources for unlawful activities.

4.4 Email and Communication Activities

Email, messaging platforms and other communication tools must be used responsibly, professionally and securely.

• Users must verify recipients before sending confidential information.
• Sensitive information should only be shared through approved communication channels.
• Suspicious emails, links and attachments must be treated carefully.
• Users must not respond to suspected phishing messages.
• Unauthorized bulk email or spam is prohibited.
• Company communication systems must not be used for harassment or unlawful activities.
• Users must not impersonate another employee, customer or organization.
• Business communications should remain professional and appropriate.

Password & Account Security

Users are responsible for protecting accounts assigned to them.

• Passwords must not be shared with colleagues or third parties.
• Users should not reuse business passwords on unrelated external services.
• Multi-factor authentication should be used where provided or required.
• Users must not store passwords in unsecured files or documents.
• Suspected credential compromise must be reported immediately.
• Users must not attempt to obtain another person's credentials.

Software & Application Usage

Software installed or used on T3 Consulting systems should be approved, appropriately licensed and required for legitimate business purposes.

• Unauthorized software installation is prohibited.
• Pirated or improperly licensed software must not be used.
• Security tools must not be disabled without authorization.
• Applications must be kept updated where required.
• Unknown executables or scripts must not be run without appropriate validation.

Use of AI & External Online Services

Users must exercise appropriate care when using artificial intelligence platforms, file-sharing services, cloud applications or other external online services.

• Confidential customer information must not be entered into unauthorized AI platforms.
• Passwords, API keys, tokens and credentials must never be submitted to public AI tools.
• Source code or proprietary information should only be shared where specifically authorized.
• External cloud or file-sharing services must be approved where required.
• Users remain responsible for reviewing AI-generated output before using it for business purposes.

Device & Endpoint Usage

Company-owned and authorized devices must be handled securely to reduce the risk of data loss, unauthorized access or malware infection.

• Devices should be locked when unattended.
• Security software must remain enabled.
• Operating systems and applications should be updated as required.
• Loss or theft of a device must be reported promptly.
• Unauthorized individuals must not be allowed to use business systems.
• Company information must not be stored on unauthorized personal devices.

Monitoring & Logging

T3 Consulting may monitor or log the use of its systems, networks and technology resources where reasonably required for security, administration, troubleshooting, compliance and operational purposes.

Monitoring may include:

• Authentication and login activity
• System and application logs
• Network activity
• Security events
• Administrative activities
• Use of company technology resources

Reporting Security Incidents

Users must promptly report suspected security incidents or policy violations.

Examples include:

• Lost or stolen devices
• Suspected phishing emails
• Malware infections
• Compromised passwords or accounts
• Unauthorized system access
• Accidental disclosure of confidential information
• Suspicious activity involving customer environments
• Known or suspected security vulnerabilities

5.1 Compliance Measurement

T3 Consulting may assess compliance with this policy through appropriate technical, administrative, operational or security reviews.

Compliance activities may include system monitoring, access reviews, security assessments, log reviews and investigation of reported incidents.

5.2 Exceptions

Any exception to this Acceptable Use Policy should be appropriately authorized before implementation where such approval is required.

Exceptions may be subject to additional controls, documentation, risk assessment or time limitations.

5.3 Non-Compliance

Failure to comply with this Acceptable Use Policy may result in appropriate corrective action, including restriction or removal of access to T3 Consulting systems and resources.

Depending on the nature and severity of the violation, additional disciplinary, contractual or legal action may be taken in accordance with applicable policies, agreements and laws.