purpose

This document aims to organize the access control management process for assets, resources, and information systems of Najran University, to ensure the protection of data and information stored and used within the university. This policy was designed to comply with national and international data management standards, as well as specifically with the personal data protection system, to provide a secure environment that guarantees the confidentiality, integrity, and availability of the university’s information, while clearly defining responsibilities and authorities to prevent unauthorized access.

Scope of Work

This policy applies to all assets and resources of Najran University, physical and digital, regardless of their classification or sensitivity. It includes all individuals and entities that are granted access to university systems or data, who are:

  • Faculty and staff in all categories
  • Students registered in the University and authorized to use any of its electronic systems.
  • Contractors and Consultants working for or on behalf of the University.
  • Any third party grants access authority within the scope of collaboration or service provision.

    • Terms and Conditions

    Firstly: General Rules for Granting and Managing Access

    • These rules are defined based on what is stated in paragraphs (2) and (2-4) of the “Cybersecurity Identity and Access Management Policy” issued by the University Cybersecurity Administration.

    Secondly: User Identity ManagementUser Identity Management

    • These rules are based on what is stated in paragraph (1) of the “Cybersecurity Identity and Access Management Policy,” approved by the Cybersecurity Administration.

    Thirdly: Password Management Policy

    • Applies This The controls According to What Responds في Paragraphs (2-2) and (2-7) from Policy Management Identities Access And permissions, Issued عن Management Cybersecurity.

    Fourthly: Review and Revocation of Access

    • relies This The controls To ما came في paragraphs (2-3) and (2-6) from Policy Management Identities Access And permissions, approved من Management Cybersecurity.

    Fifthly: Secure Log-on for SystemsSecure Log-on Procedures

    • Access to University systems is not permitted through unofficial or unapproved interfaces.
    • A legal warning message appears on the login screen indicating that the system is intended for authorized users only.
    • All successful and unsuccessful login attempts are logged in the system log, with dates and device information.
    • An automatic delay mechanism is implemented between failed attempts to reduce the risk of automated attacks (Brute Force).
    • Automated alarms are activated when the maximum limit for login attempts is exceeded.
    • Multi-factor Authentication methods are used in sensitive systems.
    • Periodic reviews (weekly) are conducted of failed login attempts (Digital Transformation Deanship and Knowledge Sources Cybersecurity Management).
    • Automatic sessions locking is enabled after a specified period of inactivity.
    • Access to the system is prevented from untrusted environments.
    • Geographic or time-based restrictions are applied as needed for access restricted by context.

    Sixth: Controlling Access to Software and Peripherals (Software & Peripheral Access)

    • The installation or use of any unapproved software is prohibited unless there is written approval from the Digital Transformation Deanship and Knowledge Sources.
    • All unnecessary services and software are removed from operating systems.
    • Access to programs is restricted through privilege control and authorization delegation.
    • All installed software is reviewed periodically to ensure its compliance with policies and security updates.
    • The installation or execution of external programs from portable storage devices is prohibited.
    • Only licensed and officially updated software versions are used.
    • Access to software is monitored via SIEM systems or central control tools.
    • The use of sensitive software is logged for auditing and review purposes.
    • The use of torrents or unauthorized remote access tools is prohibited.
    • Security controls are applied to open-source software used in the infrastructure.

    Seventh: Controlling Access to Source Code (Source Code Access Control)

    • Access to system source code is not permitted except for authorized individuals and according to official licensing.
    • Source codes are stored in secured repositories with encryption and version control enabled.
    • All changes to the code are documented within the change log.
    • Copying of source codes to personal or unprotected devices is prohibited.
    • Independent code reviews (Code Review) are performed before merging or publishing.
    • code access to configuration files and sensitivities is restricted within (such as passwords or keys).
    • periodic backups of the code are stored in an isolated environment.
    • Implements source code lifecycle management policy, from creation to cancellation.

    Roles and Responsibilities

    The Entity

    Roles and Responsibilities

    Digital Transformation Office and Knowledge Sources
    • Management and development of systems that control identity and access (such as IAM, SSO, Active Directory).
    • Creation, modification, and disabling of user accounts securely and systematically.
    • Protection of systems through the implementation of multi-factor authentication mechanisms (MFA) and single sign-on (SSO) systems.
    • Integrated linkage between the access control system and the human resources and financial systems.
    • Management of immediate access revocation mechanisms upon changes in user status or termination of employment.
    • Monitoring and recording of user activities to track logins, logouts, and any changes in permissions.
    • Performing periodic maintenance and security updates on access control systems.
    • Development and implementation of password management policies and their periodic updating
    • Conducting regular penetration tests to assess the security of access control systems.
    • Ensuring compliance with requirements for the protection of personal data and sensitive information.
    • Prepare periodic reports for senior management regarding the status and security of access systems.
    • Collaborate with Cybersecurity in technical investigations related to access incidents.

    Cybersecurity
    • Develop updated security policies to control access in compliance with ISO 27001.
    • Continuously monitor systems using tools such as SIEM and IDS/IPS to detect suspicious activity.
    • Enforce strict controls on high-privilege accounts (Privileged Access Management - PAM).
    • Implement strategies to reduce security risks related to unauthorized access.
    • Review requests for exceptions regarding access privileges and analyze potential risks.
    • Regularly assess vulnerabilities and update security controls based on assessment results.
    • Issue immediate alerts and warnings upon detection of intrusion attempts or misuse.
    • Ensure protection of systems from phishing attacks and malware associated with login attempts.
    • Review and monitor the use of premium access for sensitive accounts.
    • Developing immediate response procedures for security incidents related to access.

    Data Office
    • Defining and configuring data access levels according to classification (confidential, public, restricted, etc.).
    • Controlling data access and granting privileges only based on the principle of least privilege.
    • Ensuring the application of the “need-to-know” principle in accessing databases and repositories.
    • Identifying data owners and the levels of permissions granted to them.
    • Working with data owners to determine who can access different datasets.
    • Managing data access rights and verifying their validity periodically.
    • Monitoring data movement while ensuring that all individuals with database privileges have a justified need.
    • Ensuring compliance with local and international data protection laws (such as GDPR).
    • Following the implementation of security controls related to backup and data protection.
    • Developing mechanisms for reviewing permissions and authorizations related to data access.
    • Prepare periodic reports on data usage and compliance with access control policies.
    • Train university staff on the importance of data protection and following access control procedures.

    Risk Management
    • Conduct periodic assessments of access control risks using recognized methodologies (such as ISO 31000).
    • Develop risk mitigation plans and implement appropriate security controls.
    • Prepare comprehensive reports on the risks associated with access control.
    • Support the implementation of internal and external audits related to security risks.

    Legal Department
    • Review all policies and procedures to ensure their compliance with local and international laws.
    • Draft terms of employment contracts and security agreements with external parties.
    • Provide legal support during internal and external investigations related to information security.
    • Assess legal risks arising from data usage and privacy protection.

    Universities and units (colleges, faculties, centers, and all administrative units)
    • Analyzing job functions to determine the necessary access rights.
    • Following up on periodic review of access rights to ensure their suitability.
    • Reporting any incidents or misuse of access rights immediately.
    • Participating in risk assessments related to access to administrative unit data.
    • Coordinating with the Digital Transformation Office and knowledge sources to support access rights verification operations.
    • Supporting the implementation of security policies within the unit and compliance with them.

    relevant regulations

    University data access policy is subject to a range of systematic and regulatory frameworks, both locally and internationally, aimed at ensuring the protection and integrity of data, promoting transparency and accountability in its use. The following references are among the most prominent:

    • The National Data Governance Policy, issued by the Saudi Data & Cybercrime Agency (SDAIA), Version 1 (2020), which is the main reference for regulating data management at the national level, including access management, data ownership, and usage controls.
    • The Information Technology Crime Control System, issued under Royal Decree No. m/17 dated 26/3/1428H (2007), which criminalizes unauthorized access to data or information systems, and frames the responsibility of individuals and institutions when dealing with access privileges.
    • The Basic Controls for Cybersecurity, issued by the National Cyber Security Agency (NCA), which include Access Control controls as one of the main pillars for protecting the Kingdom’s national information infrastructure.
    • International standards adopted, such as ISO/IEC 27001:2022 for Information Security Management and ISO/IEC 27701 for Privacy and Personal Data Management, which specify technical and administrative controls to regulate access rights and define responsibilities.
    • The University is committed to implementing these systems and policies in accordance with local laws in the Kingdom of Saudi Arabia, taking into consideration international obligations related when dealing with external partners or projects funded by international entities.

    Compliance with Data Access Policy

    • Data Access Policy is mandatory for all university personnel, including faculty members, administrators, researchers, contractors, and any external entities granted access to the University’s information assets, whether for contractual, research, or operational purposes.
    • Organizational units (such as colleges, departments, and research centers) are responsible for implementing this policy at the operational level, ensuring that staff comply with the permissions granted to them and do not misuse them.
    • The Data Office is responsible for monitoring compliance with this policy, in coordination with the Cyber Security Unit, through monitoring tools, follow-up, periodic reports, and internal audit mechanisms.
    • In the event of any violation or unlawful use or exceeding authorized access privileges, it will be addressed according to the Incident Response Policy, and the violation will be referred to the relevant authorities within the University, with the possibility of escalating it to national regulatory bodies if necessary.
    • This policy is aligned with the Access Identity Management and Permissions Policy issued by the Cyber Security Administration at the University.

    Review data access policy

    • The Data Office, in collaboration with the Digital Transformation Deanship and Knowledge Sources Department and the Cyber Security Management, reviews this policy periodically (at least annually), or when there are significant changes in systems or relevant legislation, or in the university’s technical or administrative infrastructure.
    • The review includes evaluating the effectiveness of existing controls, identifying vulnerabilities or non-compliant practices, and updating procedures to keep pace with the latest technological and regulatory developments.
    • The results of the review are documented and recommendations are submitted to the Supreme Committee for Data Management and Governance at the University to approve any necessary amendments, in accordance with the approved governance procedures.