Policy on User Identity and Access Management
Document Classification: Constrained
Version: 2.0
Date: 11/02/2025
Reference: The National Cybersecurity Authority

Disclaimer:
This model was developed by the National Cybersecurity Authority as an illustrative example for business use, which can be used as a reference guide, with adjustments and modifications made by the relevant authorities at Najran University to comply with applicable legislative and regulatory requirements. This model must be approved by the Head of the Entity or the person authorized to represent them. The Authority is not liable for the use of this model as it exists, and it serves only as an illustrative example.

Table of Contents:

  1. Purpose
  2. Scope of Work
  3. Policy Items
    1. General Provisions
    2. Granting Access Authority
    3. Important and Sensitive Access Permissions Requirements
    4. Remote Access Authorization
    5. Revoking and Modifying Access Authority
    6. Reviewing User Identities and Authorities
    7. Password Management
    8. Password Protection
  4. Roles and Responsibilities
  5. Updates and Reviews
  6. Compliance with Policy


1. Purpose:
To define cybersecurity requirements related to identity and access management of information and technical assets belonging to Najran University, in order to protect them from cyber threats and internal and external risks, focusing on the primary objectives of protection: confidentiality, integrity, and availability. This policy has been aligned with controls and standards issued by the National Cybersecurity Authority and relevant regulatory and legislative requirements.

2. Scope of Work:
This policy applies to all information and technical assets of Najran University, and to all employees (staff and contractors) in the university.

3. Policy Items:
3.1 General Provisions:

  1. 1-1. It is necessary to document and approve a mechanism for granting, modifying, canceling, and monitoring access rights and to ensure its application at Najran University’s Information and Technology Assets.
  2. 1-2. Create user identities in accordance with the relevant legislation and regulations of Najran University.
  3. 1-3. User identity verification using a username and password must be performed before granting access to Najran University’s information and technology assets.
  4. 1-4. It is necessary to ensure the confidentiality of user identities, accounts, and privileges, including requesting users (employees, external parties, and users) to respect their privacy.
  5. 1-5. It is required to adopt a User Authorization Matrix document and review it based on the following access control principles:
    1. Need-to-Know and Need-to-Use Principle
    2. Segregation of Duties Principle
    3. Least Privilege Principle
  6. 1-6. It is necessary to implement controls for verifying identities and privileges on all information and technology assets through a centralized, automated system for access control such as Active Directory – Domain Services in Najran University.
  7. 1-7. The use of shared accounts (Generic User Accounts) for accessing Najran University’s information and technology assets must be prohibited.
  8. 1-8. It is necessary to ensure secure session management, including setting sessions to automatically close after a specified period (Timeout), locking sessions, and verifying session authenticity in accordance with Najran University’s approved policies on access identity and privilege management.
  9. 1-9. System and session settings must be configured to automatically terminate after a specified period of time (Timeout) in accordance with the Najran University standards set by the Access and Permissions Management Office.
  10. 1-10. System and session settings must be configured to temporarily disable them after a certain number of unsuccessful login attempts, according to the Najran University standard set by the Access and Permissions Management Office.
  11. 1-11. Inactive user accounts must be disabled in accordance with the Najran University standard set by the Access and Permissions Management Office within a specified period.
  12. 1-12. System Identity and Access Management settings must be configured to send logs to a central cybersecurity event logging and monitoring system, in accordance with Najran University policy.
  13. 1-13. Direct access to databases for sensitive systems should only be granted to Database Administrators (DBAs) after implementing the database security procedures approved by Najran University.
  14. 1-14. Service Account management procedures must be documented and approved, interactive login must be disabled, and they must be reviewed periodically in accordance with the Najran University-approved procedures.
  15. 1-15. User permissions must be managed based on the sensitivity of technical assets and the level of functional needs for work, taking into account relevant legal and regulatory requirements before employing a user and updating their account when changing duties.
  16. 1-16. Continuous Performance Indicators (KPIs) should be developed to measure the correct and effective use of Access and Permissions Management in order to ensure that security requirements are met in access.


3.2 Access Authorization:

  1. 2-1-1. Access permissions must be granted based on the user's request through an approved form from the relevant administration (direct manager or system owner) in the Cybersecurity Management System, specifying the system name, type of request, permission, and validity period (if temporary).
  2. 2-1-2. Access to university of Najran’s information and technical assets must be granted with due consideration given to relevant approvals, roles, and responsibilities.
  3. 2-1-3. A unified mechanism for creating user identities should be followed, allowing the “User ID” to be written consistently, such as using the first letter of the first name, a dot, and the last name, or the previously identified employee number by the Human Resources Department.
  4. 2-1-4. Concurrent login attempts from multiple computers for the same user must be prevented.
  5. 2-1-5. The maximum number of unsuccessful login attempts allowed should be determined according to Najran university standards set by the User Identities and Permissions Management Office to mitigate password guessing attacks.


Important and Sensitive Access Permissions Requirements:

  1. 2-2-1. System administrator (Sys ID) permissions must be assigned based on job functions, taking into account the principle of segregation of duties.
  2. 2-2-2. Password history logging should be enabled to track the number of password changes.
  3. 2-2-3. Default or privileged accounts with important and sensitive permissions (such as “Admin” or “Root” or “Sys ID”) must be renamed before deployment.
  4. 2-2-4. Privileged and sensitive accounts should be prevented from accessing the internet.
  5. 2-2-5. Must verify user accounts with important and sensitive assets through multi-factor authentication (MFA) mechanism according to the approved Najran University standards.
  6. 2-2-6. Privilege Access Management Solution must be used to protect sensitive technologies and important privileged assets.
  7. 2-2-7. Access to sensitive systems must require multi-factor authentication (MFA), and compliance with its follow-up by employees of Najran University.


3.4 Remote Access Authorization:

  1. 2-3-1. Remote access authorization must be granted to information and technical assets after obtaining prior approval from the Cyber Security Administration, and access is restricted using multi-factor authentication (MFA) via secure and approved channels.
  2. 2-3-2. All logs of events related to all remote access sessions to information and technical assets must be continuously saved and monitored.


3.5 Revoking and Modifying Access Rights:

  1. 2-4-1. Upon transfer or termination of the relationship between the user and Najran University, or changes in their duties, the Human Resources Department must notify the Information Technology Administration to disable or modify user accounts and their privileges as soon as possible and with maximum automation.
  2. 2-4-2. User event logs must be saved and preserved before disabling their access rights according to the Cyber Security Event Logging and Monitoring policy approved by Najran University.


3.6 Reviewing Identities and Permissions:

  1. 2-5-1. User IDs (User IDs) and their usage on sensitive systems must be reviewed at least annually.
  2. 2-5-2. User profiles (User Profiles) and their usage on sensitive information and technical assets must be reviewed at least annually.


3.7 Password Management:

  1. 2-6-1. A secure password policy with stringent criteria must be implemented for all accounts within Najran University, in accordance with the approved Identity and Authorization Management Policy and relevant legislation and regulatory requirements.
  2. 2-6-2. Users must be notified prior to the expiration of their passwords.
  3. 2-6-3. The use of previously used passwords must be prohibited.
  4. 2-6-4. Systems should be configured to require password changes upon initial user login.
  5. 2-6-5. All default passwords installed on all information and technical assets must be changed prior to production.
  6. 2-6-6. Default strings such as “Community,” “Public,” “Private,” and “System” used in the management of network technical assets (SNMP) should be replaced with different passwords.


3.8 Password Protection:

  1. 2-7-1. All passwords for information and technical assets must be stored and transmitted using encryption technology, in accordance with the approved Encryption Policy of Najran University.
  2. 2-7-2. Passwords must be masked when entered on the screen (Password Mask).
  3. 2-7-3. The “Remember Password” feature should be disabled on systems and applications within Najran University.
  4. 2-7-4. The use of known passwords (Dictionary) should be prevented through specific measures.
  5. 2-7-5. Password details must be submitted in a secure, reliable, and approved manner.
  6. 2-7-6. If the user requests password reset via phone or any other means, verification of the user’s identity is mandatory before resetting the password.
  7. 2-7-7. Passwords for service accounts and important, sensitive privileges must be protected and stored securely in a suitable location (sealed envelope within a safe) or using Privilege Access Management Solution.


4. Roles and Responsibilities:

  • Cybersecurity Head: Policy Owner.
  • Cybersecurity Administration: Review and update the policy.
  • Deanship of Digital Transformation and Knowledge Sources: Responsible for implementing the policy.
  • Cybersecurity Administration: Responsible for measuring compliance with the policy.


5. Updates and Reviews:
The Cybersecurity Administration must review this policy annually or when changes occur in policies, regulatory procedures, or legal and regulatory requirements related to Najran University.

6. Policy Compliance:

  • The Cybersecurity Administration must periodically ensure the compliance of all employees of Najran University with this policy.
  • All employees of Najran University must comply with this policy.
  • Any violation of this policy may result in disciplinary action against the offender according to the procedures followed at Najran University.