Data Classification Policy

Personal Data: Every statement - whatever its source or form - can lead to the specific knowledge of an individual, or make them identifiable directly or indirectly when combined with other data, including, but not limited to, name, personal identification numbers, addresses, contact numbers, bank account and credit card numbers, static or moving images of the user, and other personal data.Data: A set of facts in their raw form or in an unorganized form such as numbers, letters, static images, videos, audio recordings, or emojis.Access to data: The ability to access logical and physical data and technical resources of the University for their use.Authentication: Confirming the identity of any user or process as a fundamental requirement to allow access to technical resources.Protected data: Data classified as (highly secret, secret, restricted)General Information: Data after processing (unprotected) that the University receives, produces, or deals with, regardless of its source, form, or nature.Data classification levels: Data classification levels as displayed in the data classification policy by the National Data Management Office are as follows: Highly Secret, Secret, Restricted, PublicData representative: is the person responsible for the data collected and maintained in business departments of the university.Security Controls: Devices and procedures and policies and physical guarantees used to ensure the safety of data and protect it and protect processing media and access to it.Data Disclosure: Enabling anyone – other than the University – to obtain personal data or use it or view it in any way for any purpose.User Data: Employee who deals with or accesses data, uses it, or updates it for the purpose of performing a task authorized by the university's authority.

The purpose of this policy is:

• Organizing the classification and protection of data at Najran University according to best global practices and in accordance with the instructions received from relevant authorities.

Organizing the process of using/reusing protected data and publishing general information.Specify the roles and responsibilities required from all parties at the university to ensure the optimal application of data classification.

These rules apply to all data that the University receives, generates, or handles, regardless of its source, form, or nature, including paper records, meetings, communications through social media and applications, emails, data stored on electronic media, audio or video tapes, maps, photographs, manuscripts, handwritten documents, or any other form of information.

The Party	The Roles and Responsibilities	The Permanent Supreme Committee for Data Management and Governance Approval of the Policy The timeline plan for university data classification has been approved. Address any difficulties or challenges that impede the data classification process. The Permanent Committee for Data Quality and Decision Support
Supervision of the University’s data ranking process in accordance with applicable systems, regulations, and ordinances, while enhancing secure access methods. Proposed Solutions for Improving Data Classification Procedures.The recommendation is to escalate to the Permanent High Committee for Data Management and Governance when necessary. Data Management Office Review the data classification policy periodically. Proposal for the formation of subcommittees - in accordance with what requires the interest of work to complete the related data classification tasks and raise them for approval by the authorized party.Following up on the work of specialized committees responsible for data classification to ensure that all university data is classified by representatives from private businesses. Proposal regarding procedural evidence for data classification and recommendation for its adoption by the Permanent Supreme Committee for Data Management and Governance.Follow up on periodic reports for subcommittees related to data classification. Ensure that the security standards used when exchanging data between internal and external entities of the university are verified. Raise awareness among university staff (faculty members and employees) about the importance of data governance, its classification methods, exchange, dissemination, and publishing. Business Departments (and all colleges and units in the University) The business departments at the University implement the University-approved data classification policy, which includes: This encompasses the inventory and classification of all data assets (including all incoming paper transactions to the entity within the university that have not been registered in any of the university’s systems). The agent representative should be fully informed on the nature of the administrative unit's data.Data classification review and approval of business administration levels.Data classification within the entity based on what is stated in this policy.	Business Data Representative	Each business administration assigns a data representative to perform the following tasks: Data Classification: Classify the data collected by the entity and its affiliated units and offices. Data aggregation: Ensuring that data classified from multiple sources is categorized at the highest classification levels used when classifying data individually. ‏Collection of data: Confirming the classification of data collected from multiple sources at the highest classification levels used in classifying data individually. ? ‏Data classification formatting: Ensuring that exchange data is classified and protected ‏in a coordinated manner. ? ‏Compliance with Data Classification (in coordination with ‏Business Data Specialists): Ensuring that data is protected according to the specified controls.	Deanship of Digital Transformation - Knowledge Sources Applying the controls to data according to the classifications approved by the Data Management Office. Technical and Information Support for Business Departments, which includes, but is not limited to: Database access for electronic systems at the University.Providing and updating metadata for databases for university electronic systems based on the approved models from the Data Management Office and sharing them with concerned organizational units. Applying the necessary security and protection to electronic data in the university based on its classification.Report to the Cyber Security Administration and the Data Office about any violations observed that pose a threat to data security. Perform regular data backups.Data recovery from backup media when needed.	Business Data Specific The Digital Transformation Deanship and the Knowledge Sources Administration, along with Cyber Security Management, under an authorization to carry out the following tasks: Ensure that access control measures are applied and monitored, and reviewed in accordance with the data classification levels defined by the business data representative.Preparing periodic reports on the quality, integrity, confidentiality, and sharing of classified data with related departments.In compliance with data classification (in collaboration with data officers).Ensure the classification of data belonging to the entity and its protection, in accordance with the specified controls within this policy.	Cybersecurity Administration
Supervision and monitoring of data implementation according to the approved classification, ensuring alignment with policies and controls issued by the National Cybersecurity Authority. Coordinate with the Financial Administration to provide the necessary software to detect and protect data leaks. Monitoring of activities performed on data, recording them, including data related to the person accessing this data and periodic sharing with the Data Management Office to ensure compliance with the operation of this policy. Governance and Risk Management and Business Continuity	Review of compliance reports with the data classification policy and methods for preserving this data, as well as identifying the consequences of non-compliance with necessary security procedures to protect data and sharing these reports with the University Data Management Office.	Internal Audit Department Tracking the availability of reports on compliance with data classification policy by business departments in the university according to the schedule for implementing this policy.	Data User The user of the data is committed to complying with this policy and all policies related to the use of data in the Kingdom of Saudi Arabia.

The first principle: Data availability

The basis for data is that it should be available (in the developmental field) unless its nature or sensitivity requires higher levels of classification and protection, and extreme secrecy (in the political and security fields) unless its nature or sensitivity requires lower levels of classification and protection.

The Second Principle: Necessity and Proportionality

Data is classified into levels according to its nature, sensitivity level, and impact degree, taking into consideration the balance between its value and its level of secrecy.

Third Principle: Classification at the Appropriate Time

Data is classified upon its creation or receipt from other entities, and the classification occurs within a defined time period.

The Fourth Principle: Higher Level of Protection

A higher level of classification is adopted when the content includes a comprehensive set of data with different classification levels.

The Fifth Principle: Separation of Duties

Tasks and responsibilities of employees – with regard to the classification, access, disclosure, use, modification, or destruction of data – are separated in a way that prevents overlap of duties and avoids diffusion of responsibility.

The Sixth Principle: The Need for Knowledge

Access to data and its use are restricted based on actual need for knowledge, and for the minimum number of employees.

The seventh principle: Least privilege

The granting of employee authorities is at least restricted to the privileges necessary for performing the tasks and responsibilities assigned to them.

Classification Level

Impact Rating

Highly confidential

High

Description

The data is classified as highly confidential if access to it or disclosure of its content or material thereof results in grave and exceptional damage that cannot be remedied or compensated for on:

• Including national interests, including breaches of agreements and treaties, or damage to the Kingdom's reputation or diplomatic relations and political affiliations, operational efficiency of security or military operations or the national economy or the national infrastructure or government activities.

The performance of public bodies causing harm to national interests.

The health and safety of individuals and a wide range of privacy for senior officialsThe resources are the environment or nature.Level of Ranking

Impact Rating

Secret

Secondary

Description

The data is classified as confidential data if unauthorized access to it or disclosure of its content or elements leads to serious harm to:

• National interests such as causing partial damage to the Kingdom's reputation or diplomatic relations and/or operational efficiency of national security, military or economic operations, or national infrastructure or government activities.
• Financial losses at the organizational level leading to the bankruptcy or inability of entities to perform their tasks or significant loss of competitive capabilities or both
• It causes serious harm or injury that affects the lives of a group of individuals.
• This can cause long-term damage to environmental or natural resources.
• Investigation of major issues specified by law, such as the financing of terrorism.

Ranking Level

Impact Rating

Restricted

Low

Description

Data is classified as “restricted” if unauthorized access to this data or disclosure of it or its content would lead to:
• Specific limited negative impact on the work of public authorities and economic activities in the Kingdom, as well as on the work of a specific individual.
Limited damage to nearby environmental or natural resources.

Level of Classification

Impact Rating

Year

There is no

Description

Classified as “public data” when access to it, disclosure of its content, or its contents do not result in any of the aforementioned effects in the event of no impact on the following:

• The National Interest.
• Activities of the bodies.
• Individual interests.
• Environmental Resources.
The classified data can be categorized into sub-levels based on the scope of impact as follows:
• Restricted - Level ( : If the scope of impact is at a sector level or for a general economic activity.
Restricted - Level (in the scope of activities of multiple parties or interests of a group of individuals).Restricted – Level (j): If the scope of impact is at the level of activities of a single entity or the interests of a specific individual.And in the table below, there is clarification and determination of the correct classification level that the university can assess the impact resulting from unauthorized access to data or disclosure thereof or its content. For more information about the assessment process, you can refer to the necessary steps to classify the data. The university must conduct an impact assessment related to unauthorized access or disclosure processes. This list is not comprehensive.

Restricted

			Data Classification Levels
			Highly confidential	Year	Main Impact Category, Sub-Impact Category, Considerations			Level of Impact
High
Medium	Low No available
National Interest	The Kingdom's Reputation Will the information be of interest to local or international media outlets? Will it give a negative impression?	Reputation is significantly affected	Reputation is somewhat affected	Do not affect the reputation	No impact on vital national interests	Diplomatic Relations Could the information pose a threat to relations with friendly countries? Will it increase international tensions? Could it lead to protests or sanctions from other countries?	severing diplomatic relations and political affiliations or threatening agreements and the terms of treaties, or both.	Long-term diplomatic relations are negatively affected	There will be no impact on diplomatic relations or a minor impact in the short term

Restricted

Year

Data Classification Levels

Highly Confidential

Secret

Main Impact Category, Sub-Impact Category, Considerations Level of Impact

High

Medium

Low No available

National Interest

National Security / Public Order

Will the information – if published – assist in organizing terrorist activities or committing serious crimes? Does it pose a source of panic for everyone?

the operational efficiency of public security or the intelligence operations of military forces is greatly affected

Long-term impact on the ability and efficiency of security authorities in investigating and prosecuting serious organized crimes that cause internal instability

It has a significant impact on the operational efficiency of security operations at regional or local levels, and it prevents the detection of minor crimes in the short term

There is no impact on vital national interests

National Economy Would revealing information lead to economic losses at the national level?

This has a long-term impact on the national economy with an unmanageable decline in the gross domestic product or financial market prices, unemployment rate, purchasing power, or other related indicators which negatively reflects on all sectors in the Kingdom

This has a long-term impact on the national economy with a decline that can be addressed in terms of GDP and unemployment rate or financial market prices or purchasing power, which negatively reflects on one or more sectors A slight impact on the national economy with a decline that can be addressed in a short period in terms of gross domestic product, employment rate or financial markets prices or purchasing power, which negatively reflects on only one sector

National Infrastructure

Does access to critical national infrastructure such as energy, transportation, and communications lead to disruption? In the event of cyberattacks, will essential services in the Kingdom remain available?

The cessation and disruption of the security and operations of vital national infrastructure, as well as affecting many sectors and disrupting normal life

Interruptions and outages - for a short period - in national vital infrastructure security and operations, affecting one or more sectors No damage or short-term impact will occur to the security and operations of local/regional infrastructure.

Government Agencies' Tasks Will revealing it lead to a reduction in the ability of government agencies to carry out their daily operations and tasks?

The inability of all government agencies to perform their main tasks and operations for a long period

A governmental entity’s or entities’ inability to perform one or more of its primary duties for a short period

The inability of a governmental entity or more to perform one or more non-essential tasks for a short period

University and its Branches

University Works and Services Would revealing information lead to a reduction in the ability of university units to carry out their daily operations and tasks?

All units within the university are unable to perform their primary tasks and operations

The inability of more than one organizational unit (such as a university, a specific branch, etc.) to perform one or more of its main tasks

The inability of a single regulatory unit (such as a university, a specific branch, etc.) to perform one or more of its primary tasks

There is no impact on the University's activities and branches.

University Infrastructure

Does access to university critical infrastructure, such as information technology, etc., lead to disruption? In the event of cyberattacks, will essential university services remain available?

The interruption and failure of security and infrastructure operations in an organizational unit or branch or more, leading to the disruption of normal life

The interruption and partial failure in security and infrastructure operations within an organizational unit or branch or more

Minor damage or impact to the University's infrastructure security and operations

Material Losses

Does disclosure of information result in financial losses for the university

Impact on the University with a decline that cannot be remedied in assets or income or other relevant financial indicators impact on the university with a decrease that can be remedied in the university’s assets or other related financial indicators.A slight impact on the university with a manageable decrease that can be addressed in a short period, concerning the university's assets or revenues or other relevant financial indicators.

Activities of Other Entities

Private sector profits

Will the disclosure of information lead to financial losses or bankruptcy for private entities managing public facilities? For example, the possibility of fraud, illegal money transfers, and unlawful seizure of assets.

has a significant negative impact on private entities to the extent that it harms vital national interests.

incurring significant financial losses which may lead to bankruptcy Limited damage consists of limited financial loss to the party or any of its assets.

No impact on agency activities Private Agencies’ Tasks Will disclosing it lead to harm for private entities that manage public facilities? Will this result in the loss of a pioneering role or the loss of any assets?

Inability to perform core tasks and a significant loss of competitiveness

Inability to perform one of the key tasks and limited loss of competitiveness

Data Classification Levels

Highly confidential

Sari Restricted

Year

Main Impact Category, Sub-Impact Category, Considerations

Level of Impact

High

Medium

Low No data

Individuals

Ministry of Health / Individual Safety Would disclosing information lead to the disclosure of names or locations of individuals and so on? (For example, the names and locations of secret clients, and people subject to special protection systems.)

General or severe loss of life; the loss of the life of an individual or a group of individuals

Causes serious damage or injury threatening the individual’s life

Minor injury without any risk threatening the individual's life or health

No impact on individuals

Privacy Will disclosing information constitute a breach of individuals' privacy? Will that lead to any infringement of intellectual property rights?

The disclosure of personal data for a key individual which affects national interest.

Disclosure of Personal Data for a Key Individual

Disclosure of personal data for an individual

Environment

Environmental Resources Will this information be used to develop a service or product that could lead to the destruction of the Kingdom's environmental or natural resources?

catastrophic impact that cannot be remedied on the environment or natural resources

Long-term impact on the environment or natural resources

Short-term or limited impact on the environment or natural resources

There is no environmental impact

• All unclassified data must be classified within a specified period according to an action plan prepared by the Data Management Office of the University and approved by the University President or his designee

Unclassified data when created or received is treated as “restricted” until classified.Based on classification levels, appropriate security controls are determined and applied to protect data, to ensure its handling, processing, sharing, and disposal securely.Update security systems periodically to monitor classified data storage devices “highly secret,” “secret,” and “restricted,” to ensure the protection of this data from unauthorized access.

Data classified as "Highly Confidential", "Confidential", and "Restricted" must be protected when stored physically or electronically using approved methods from the National Cybersecurity Authority.

1. Appointment of Business Representatives:

The decision to appoint data representatives for various administrative units within the University is made by the esteemed President of the University or by an authorized individual. This determination will be based on recommendations from the General Supervisor of the Data Office/Director of the Data Office.

2. University data is restricted:

• All of the university's data, which is held through business data representatives and through parties participating with the university, are identified and documented by them. The University’s data sources can be defined as follows:

Internal Data Sources

It includes Business Departments and Internal Systems that generate data for the University through the implementation of operations and services, and includes sources such as examples not limited to: paper or digital copies of reports worked on by internal departments or data known through systems used.

External Data Sources

This includes external entities that provide the agreed-upon data to the university for executing operations and services, including these sources as examples not limited to: student data providers, government agencies related thereto, and other supervisory bodies.

 

• يتم تحديد قنوات تبادل البيانات والتي تشمل القنوات الآلية والقنوات اليدوية. حيث تشمل القنوات الآلية كافة القنوات الآلية وشبه الآلية مثل رسائل البريد الإلكتروني والرسائل القصيرة وغيرها من القنوات الخاصة بالأنظمة الالكترونية. بينما تشمل القنوات اليدوية جميع القنوات غير التقنية مثل الأقراص المدمجة ووحدات التخزين USB والأقراص الصلبة الخارجية والوثائق الورقية.

3. إجراء عملية تقييم الأثر:

يجب على ممثل بيانات الأعمال اتباع الخطوات اللازمة لعملية تقييم الأثر المحتمل الذي يترتب على:

• الإفصاح عن هذه البيانات أو الوصول غير المصرح به لها.
• إجراء تعديل على هذه البيانات أو إتلافها أو كليهما.
• عدم الوصول إلى هذه البيانات في الوقت المناسب.

تبدأ عملية تقييم الأثر بتطبيق مبدأ "الأصل في البيانات الاتاحة" (في المجال التنموي) مالم تقتض طبيعتها أو حساسيتها مستويات أعلى من التصنيف والحماية وسرية للغاية (في المجال السياسي والأمني) مالم تقتض طبيعتها أو حساسيتها مستويات أدني من التصنيف. يتمثل العنصر الأول من عملية تقييم الأثر في تحديد الفئة الرئيسية والفرعية للأثر المحتمل في أي من الفئات الرئيسية التالية:

• المصلحة الوطنية
• أنشطة الجهات
• صحة أو سلامة الأفراد
• الموارد البيئية

4. تحديد مستوى الأثر:

يتعين على ممثل بيانات الأعمال أن يحدد لكل أثر محتمل مستوى معين يعتمد تحديد المستوى على الآتي:

• مدة الأثر وصعوبة السيطرة على الضرر.
• فترة تدارك وإصلاح الأضرار بعد وقوعها.
• حجم الأثر على مستوى وطني، مناطقي، عدة جهات، جهة واحدة، عدة أفراد .... الخ .
• كما يمكن تحديد مستوى الأثر من خلال المعايير أدناه:
• عالي يؤدي الوصول الى البيانات أو الإفصاح عنها إلى حدوث أضرار جسيمة أو خطيرة للغاية على المدى الطويل لا يمكن تداركها أو إصلاحها.
• متوسط يؤدي الوصول إلى البيانات أو الإفصاح عنها إلى حدوث أضرار جسيمة أو خطيرة يصعب السيطرة عليها.

• منخفض يؤدي الوصول إلى البيانات أو الإفصاح عنها إلى أضرار محدودة يمكن السيطرة عليها أو أضرار متقطعة على المدى القصير يمكن السيطرة عليها.
• لا يوجد أثر، لا يؤدي الوصول إلى البيانات أو الإفصاح عنها إلى اي ضرر على المدى الطويل أو القصير.
• يجب ان تكون جميع الاضرار المحتملة والمحددة خلال عملية تقييم الأثر محددة وقائمة على أدلة، في محاولة للحد من التقديرات الشخصية للمكلف بإجراء تصنيف البيانات. يحدد ممثل بيانات الاعمال مستوى تصنيف البيانات بناءً على الأثار المحددة ومستوياتها:
• عالي، تصنف البيانات باعتبارها "سرية للغاية".
• متوسط، تصنف البيانات على انها "سرية".
• منخفض، يلزم إجراء المزيد من التقييمات (من خلال القيام بالخطوات 5، 6)
• لا يوجد أثر، تصنف البيانات على أنّها بيانات "عامة".

5. تحديد الأنظمة ذات العلاقة (فقط إذا كان مستوى الأثر منخفض):

يجب إجراء تقييمات إضافية إذا كان مستوى الأثر المحدد “منخفض" وذلك بهدف زيادة مستوى تصنيف البيانات المصنفة على أنها بيانات “عامة" إلى الحد الأقصى. يجب على ممثل بيانات الأعمال في هذا الصدد، دراسة ما إذا كان الإفصاح عن هذه البيانات يتعارض مع أنظمة المملكة العربية السعودية مثل نظام مكافحة الجرائم المعلوماتية ونظام التجارة الإلكترونية ... الخ وإذا كان الإفصاح عن البيانات مخالفاً للأنظمة، فيجب حينها تصنيف البيانات على أنها بيانات “مقيّدة"، بخلاف ذلك يتعين على ممثل بيانات الأعمال مواصلة تنفيذ الخطوة 5.

6. الموازنة بين مزايا الإفصاح عن البيانات والآثار السلبية (فقط إذا كانت الإجابة على الخطوة 5 “لا"):

بعد التأكد من مستوى الأثر المنخفض وضمان أن الإفصاح لن يكون انتهاكاً لأي نظام نافذ، يجب أيضاً تقييم المزايا المحتملة للإفصاح عن مثل هذه البيانات والتأكد مما إذا كانت هذه المزايا ستفوق الآثار السلبية أم لا، وتشمل المزايا المحتملة استخدام البيانات لتطوير خدمات جديدة ذات قيمة مضافة، أو زيادة شفافية العمليات الحكومية أو زيادة مشاركة الأفراد مع الحكومة. وعليه:

• إذا كانت المزايا أكبر من الآثار السلبية، تصنف البيانات على أنها "عامة".
• إذا كانت المزايا أقل من الآثار السلبية، تصنف البيانات على أنها "مقيّدة".

7. مراجعة مستوى التصنيف:

يجب أن يفحص مراجع تصنيف البيانات -أحد منسوبي مكتب إدارة البيانات بالجامعة- جميع البيانات المصنفة لضمان أن يكون مستوى التصنيف المحدد من جانب ممثل بيانات الأعمال هو الأنسب، وتتم مراجعته خلال شهر واحد من التصنيف الأولي.

8. تطبيق الضوابط المناسبة:

تتمثل الخطوة الأخيرة من عملية تصنيف البيانات في حماية جميع البيانات وفقاً لمستوى التصنيف عن طريق تعميم نتائج التصنيف وتطبيق ضوابط تصنيف البيانات. بحيث يتم الانتهاء من عملية التصنيف عند تصنيف جميع البيانات التي تملكها الجامعة والتحقق من مستويات التصنيف وتطبيق الضوابط ذات الصلة.