Cybersecurity Awareness Month

Awareness Month Small habits. Safer work. Cybersecurity Awareness Month for every Northstar employee, in offices and on the frontline. This fictional Northstar example focuses on one practical security theme each week. Use the guides as everyday reminders and follow confirmed Northstar procedures whenever a company-specific action is required. Choose this week's guide Open a topic for practical tips, or review the drill recap. Passwords & MFA Protect work sign-ins and respond carefully to authentication prompts. Phishing Pause on unexpected messages and use the confirmed reporting route. Devices Use safer defaults on work devices in different work settings. Data Check the audience and destination before sharing work information. Drill Recap Review the exercise's purpose and practical takeaways. Four themes, one useful habit at a time These are general reminders, not substitutes for Northstar's confirmed security procedures. Week 1: Passwords & MFA Use a unique work password, keep it private, and approve an MFA prompt only when you initiated the sign-in. Never share a password or one-time authentication code. Report an unexpected MFA prompt through Northstar's confirmed security route. Week 1 Week 2: Phishing Treat unexpected links, attachments, and urgent requests as reasons to pause and verify. Do not open a suspicious attachment or follow its link. Use the approved message-reporting process once Northstar confirms it. Week 2 Week 3: Devices Lock a work device when you step away and install updates only through approved channels. Keep work screens and devices from being casually viewed or used by others. Report a lost or damaged work device through the confirmed route promptly. Week 3 Week 4: Data Share work information only with people who need it, using approved storage and sharing tools. Check recipients and attachment contents before sending. Use Policy Hub for Northstar's authoritative data-handling guidance. Week 4 Assigned learning is in Training Open the Training app to check whether cybersecurity learning has been assigned to you. Training is for learning. Use Northstar's confirmed security reporting process for suspicious messages or security incidents. Look for assigned cybersecurity courses in Training. Follow the course instructions and complete any required learning by its stated due date. If an assignment is missing or inaccessible, use your organization's established support route. Week 1: Passwords & MFA Protect your sign-in Use a unique work password, never share it, and approve an MFA prompt only when you initiated the sign-in. If you receive an MFA request you did not start, do not approve it . Use Northstar's confirmed security reporting route. Do not share passwords, one-time codes, or recovery codes with anyone who asks by message, phone, or in person. Follow Northstar's approved sign-in requirements. This sample does not establish which MFA methods are required or whether a password manager is provided. Habits that help Keep work credentials separate Use a password that is not reused on personal or other work accounts. Keep it private, including from coworkers and people claiming to provide support. Do not write a password where another person can see it. Use only a password manager explicitly approved and provided by Northstar. Check every unexpected prompt An MFA prompt you did not initiate may indicate someone is trying to access your account. Do not approve it or share a code. Stop and use the confirmed security reporting route. If you are unsure whether a sign-in is yours, do not approve the prompt while you verify. Check Training for assigned learning The Training app is the destination for assigned password and MFA learning. If Northstar has not confirmed a password-manager option, do not store work credentials in an unapproved tool. Open Training and check your assigned courses. Use the course's stated instructions and due date if a course is assigned. Continue to another topic Awareness Month Return to the overview of all four themes. Week 2: Phishing Learn what to do when an unexpected message arrives. Week 2: Phishing Pause before responding An unexpected request, unusual link, unfamiliar attachment, or pressure to act quickly is a reason to verify—not proof by itself that a message is malicious. Check whether the sender and request make sense in context. Be cautious if a message asks for a password, one-time code, payment, sensitive information, or an unusual change to a normal process. Do not use contact details or links in a message you are trying to verify. Northstar's exact reporting route is an organization-specific setup item. Confirm and publish that route before using this page as reporting instructions. If a message seems suspicious Use Northstar's confirmed reporting process; do not forward a suspicious message unless that process specifically tells you to. Pause Do not reply, follow links, open attachments, or provide information while you check the request. Verify through a trusted route If the request appears to come from someone you know, contact them using a work channel or details you already trust—not details supplied in the message. Report using the approved route Use Northstar's confirmed message-reporting process. Do not guess at an address, button, or app destination. Ask for help if unsure Use your organization's established security or IT support route. If you already clicked, replied, or shared information, report that promptly through the confirmed route. Training is not the reporting route Use the Training app for assigned phishing learning; use Northstar's approved process to report a real suspicious message. Check Training for an assigned phishing course or exercise. For a real suspicious message, follow the confirmed reporting process—not a course or this page. Related guidance Week 4: Data Review safe recipient checks and information sharing. Drill Recap See the purpose and sample takeaways from a phishing exercise. Week 3: Devices Keep work devices in your control Lock a work device when you step away, install updates through approved channels, and promptly report a lost or damaged device using Northstar's confirmed route. These are general reminders for office, home, travel, and frontline work. Follow any additional instructions Northstar provides for your role, location, or device. This page does not establish local device rules or an incident-reporting contact. Make safer device choices When stepping away Lock the screen before leaving a work device unattended, even briefly. Do not leave a shared workstation signed in for the next person. Keep devices and screens positioned so passersby cannot casually view work information. When updating or connecting Install updates through Northstar-approved channels and follow the setup instructions for your work device. Do not install unknown apps or tools to solve a work problem. Use only connection methods authorized for your role and location. When a device is lost or damaged Report it promptly using Northstar's confirmed device-support or security route. Share what happened and when, using the approved reporting process. Do not attempt an unfamiliar repair or data wipe unless Northstar's instructions tell you to. Check Training for device guidance Use the Training app for any assigned device-security learning. Review any assigned device or mobile-security course in Training. For a lost or damaged device, use Northstar's confirmed reporting route rather than waiting for a course. Related guidance Week 2: Phishing Know how to pause and respond to a suspicious message. Week 4: Data Review careful handling of work information. Week 4: Data Check before you share Share work information only with people who need it, check recipients before sending, and use approved storage and sharing tools. Before sending a message or file, confirm the recipients, the information included, and whether the destination is approved for that information. Use Northstar's authoritative policies for rules about personal, confidential, or regulated data; this general reminder does not replace those requirements. For a shared or frontline workstation, check that the next user cannot see an open document or account you have finished using. Northstar policies in Policy Hub Check Training for assigned data learning Assigned data-protection learning is available through the Training app when Northstar has configured it for your account. Open Training and check for assigned data-protection courses. Use Policy Hub for the authoritative policy; a training course is not a replacement for policy requirements. Return to the overview or recap Awareness Month See the four weekly themes and choose another guide. Drill Recap Review the phishing exercise and its practical lessons. Drill Recap A drill is practice, not a test of character A phishing exercise helps Northstar identify where clearer guidance and practice can support safer decisions. This page uses fictional sample figures to show one way to summarize an exercise. They are not Northstar results and must be replaced only with approved results from a confirmed drill before publication as a real recap. If you receive a real message that seems suspicious, follow Northstar's confirmed reporting process. If you clicked a link, opened an attachment, or shared information, report that promptly through the same confirmed route. Illustrative drill results only Fictional example figures for layout demonstration; not measured Northstar activity. employees included in this fictional example 1,200 completed the sample exercise 84% selected a simulated link in the sample 6% used the simulated report action in the sample 11% Useful takeaways for next time These sample takeaways are general reminders, not a claim about what Northstar employees did. Pause when a request feels out of context A familiar name or a polished message does not by itself confirm that a request is genuine. Check the request against what you expected. Verify through a work channel you already trust. Use the confirmed reporting route A prompt report helps the organization respond; do not guess which reporting option to use. Follow Northstar's approved process for suspicious messages. If you already interacted with a message, include that fact when reporting. Follow up in Training If Northstar assigns follow-up learning after a drill, check the Training app for the course and its stated due date. Review assigned learning in Training. Use the confirmed reporting process for a real security concern; do not wait for follow-up training. Revisit the guidance Awareness Month Return to the overview and weekly themes. Week 2: Phishing Review how to pause, verify, and report a suspicious message.