the purpose of the policy

This document aims to clarify and define the process of managing the lifecycle of all data owned by Najran University in the field of storage and preservation of data. This policy has been aligned with national data management controls and specifications for data storage and preservation and the personal data protection system.

Scope of work

The scope of this policy applies to all data and systems owned by Najran University.

Terms of Storage and Disaster Protection

  1. Infrastructure for Storage:
    • Sitesafe
  • NetworkHighEfficiency.
  • serversandstoragespacessuitable.
  • The establishment of a secure infrastructure for data storage ensures its absence of loss..

    1. Copy Backupand Restore
      • Providesaclearplanforthecompetentdean.
  • Backupofcopiesandstorageinmultipleandsecurelocations.
  • Implementation of a backup system that ensures the possibility of data recovery in its entirety in the event of a disaster in the system

    1. Cybersecurity Applications:
    • Ensurethe safety ofthe preservation environment and its updates, examining it and following up on its updates.
  •  Usemulti-levelsecuritytoprotectdatafromunauthorizedaccess.
  •  Data encryptionduringvarioussystemoperations,includingtransferringorstoringit.

    • steps to establish the infrastructure

    1. Multi-level technical design
    • Verification of used licenses and systems and ensuring the readiness of network connection operations and security procedures correctly
    • Geographical distribution of backups which reduces the risk of data loss and facilitates their retrieval

    1. Backup and Restore
    • Verification of backup integrity by periodically restoring them randomly.
    • Encryption at operating system level.
    • Using mirroring backup system to achieve greater security.
    1. Data protection:
    • Data encryption.
    • Network perimeter protection
    • Hosting environment protection

    1. Ensuring effective monitoring:
    • Using monitoring and tracking tools for system status.
    • Ensure that necessary updates are enabled on backup systems.
    1. Disaster recovery plans:
    • Ensure the existence of disaster recovery plans and prepare for them.
    • Conducting regular tests of disaster response plans through the Deanship.

    steps to implement the backup system

    First: Specify Types Data and classifying it Building On Its importance and its sensitivity to determine and ordering Priorities Backups.

    Secondly: Selection Strategic Appropriate For backup The reserve Using Method Backup Complete أو partial On What occurred Only من Change On Data.

    Thirdly: Selection Tools Appropriate And this من during using tools Backup known with its efficiency its existence high

    Fourthly: storage Backup backup في locations geographic Multiple أو Using Systems Computing Cloud مع Tracking spaces Storage And guarantee Availability.

    Fifthly: Conducting periodic restore tests to ensure that backup systems always function as required.

    steps to retrieve data

    • Data recovery is guaranteed through the existence of a clear recovery plan to ensure business continuity and respond to disasters. By identifying critical data within the university, the entity can build a data recovery plan for critical data in the event of disasters.
    • Recovery levels were classified based on time, objectives, or required point of recovery.
    • Selecting appropriate tools.
    • Establishing service level agreements to ensure quality and achieve the desired goals of the recovery process.
    • Training direct work teams for backups and providing them with the necessary knowledge and skills.
    • Conducting periodic tests.
    • Reviewing the recovery plan annually or every 3 years.

    Steps to implement cybersecurity

    • Network protection through the use of FIREWALLS or intrusion detection systems.
  • Protectionondeviceandsoftwareduringupdaterequiredonsystemsorsoftware.
  • Protectionofdataduringscientificaccesstodataorbyencryptingthedatainthecaseofitstransferorstartingthebackupprocess.

    • Data retention period

    Commitment to periods defined by the regulations of the entities owning the data.

    Data Retention Policies Development

    The

    The points that should be considered in defining the periods for preserving the data:

    • CategorizationofData
  • Review and Follow-up Periods.

    • rules of deletion and addition

    To ensure the deletion and addition of and to backup reliable and effective measures for setting the process:

    • Documentation of procedures and their writing and awareness of working with them .
  • Assigning responsibilities and definingauthorities
  • Approval of the automation and that to ensure the application of policies deletion of data automatically.

    • Procedures in case of data loss

    First: Dealingwiththelossofdata:

    • Formation of a high efficiency team for handling cases of disasters
    • Identifyingtheactualcausesbehindthelossofdataandthatusingsystemsthatrevealdisastercases

    Secondly: Reconstruction and Data Recovery:

    • Develop plans for data recovery using the backups that have been made.
    • Examination and verification of the integrity of recovered data to ensure that it has not been affected or damaged.

    Response Team and Governance at the University

    This team provides a comprehensive framework for maintaining a secure and healthy data environment, and it is the backbone of data management at the university. This team develops and implements and maintains effective policies for data storage, retention, destruction, and recovery in emergency situations.

    First: standards Team:

    • Efficiency Technical.
    • Response For emergencies.
    • Compliance with laws and regulations.
    • Collaboration and Coordination.

    Roles and Responsibilities

    م

    The Entity

    The Role

    Responsibilities

    1

    Data Management Office

    Follow-up and Review of the Policy and Updating it
    • Periodic follow-up with the Deanship and ensuring the application of storage and backup policies.
    • Ensuring compliance with regulations and systems related to data and its lifecycle management process.

    2

    Deanship of Digital Transformation and Knowledge Sources

    Implementing the Policy and Applying it
    • Establishing appropriate controls for data storage, retrieval, and handling according to this policy.
    • Providing the necessary systems for data security.
    • Backing up information and university of Najran’s data and software on internal and external storage media. And providing the main data for backups, which include the following:
    • Version Number.
    • Date.
    • Version Description.
    • Version Sequence Numbering.
    • Authorization for Backup Access is Only Through the Responsible Party in the Deanship.
    • Verification of Preservation Procedures.
    • Periodic and Random Verification of the Possibility of Applying a Backup to the Working Environment.
    • Verification of the Recoverability of the Saved Backups Completely.
    • Classification of Storage Operations.
    • Determine the Number of Backup Replication Occurrences and Set Minimum Limits for Retention Periods and Replication Counts.
    • Maintain at Least One Valid Backup in a Secure Environment Permanently and Outside the Boundaries of Najran University Campus.
    • Document Data Recovery Operations and Verify Them Periodically.
    • Establish and Document Mechanisms for Verifying Information Received from Entities and Develop the Necessary Forms Therefor.
    • Store Sensitive Data Encrypted to Ensure Unauthorized Access is Prevented.

    3

    Cybersecurity Administration

    Guaranteeing data security
    • Ensuring the application of cybersecurity regulations in the field of data storage.
    • Guaranteeing data security and ensuring the application of policies related to it.

    Procedures for legal violations of the storage and retention policy

    • Revoke all privileges granted to the employee.
    • Deny access to the university’s systems.
    • Financial or disciplinary penalties may apply.