Acceptable Use Policy of Technical Assets
Document Classification: Internal – Restricted

Purpose

The purpose of this policy is to define the acceptable use requirements for Najran University in reducing its cyber risks and protecting it from internal and external threats, through focusing on the core protection objectives which are: confidentiality, integrity, and availability of information.

This policy has been aligned with the guidelines and standards issued by the National Cybersecurity Authority and related regulatory and legislative requirements.

Scope of Work

This policy covers all information and technical assets belonging to Najran University, and applies to all employees (staff and contractors) of Najran University.

  1. General Provisions
    • 1-1. Information must be handled according to the specified classification, in accordance with Najran University’s Data Classification Policy and Data Protection and Information Security Policy, ensuring the confidentiality, integrity, and availability of information.
    • 1-2. It is prohibited to infringe upon the rights of any person or company protected by copyrights, patents, or other intellectual property laws or regulations; including installing unauthorized software or through illegal means.
    • 1-3. Printed materials should not be left unattended on the shared printer.
    • 1-4. External storage devices (such as USB drives, portable hard drives) must be secured appropriately, such as setting a suitable password and storing them in an isolated and secure location.
    • 1-5. The use of another user’s or subordinate’s access card or password on any device is prohibited.
    • 1-6. Compliance with the Clean Desk Policy and general cleanliness standards must be maintained; ensuring that the desk surface and display screen are free from classified or sensitive information.
    • 1-7. Disclosure of any information relating to Najran University, including information related to systems and networks, shall not be made to any unauthorized party, whether internally or externally.
    • 1-8. It is prohibited to publish information belonging to Najran University through media outlets or social media without prior approval.
    • 1-9. The use of university assets and property of Najran University is prohibited for private gain or any personal activities that do not align with the university’s mission and security objectives.
    • 1-10. Connecting personal devices to the university networks or private systems of Najran University is prohibited without prior approval and in accordance with the Mobile Device Security Policy (BYOD).
    • 1-11. It is prohibited to undertake any activity that violates approved security controls, such as installing malicious software or bypassing antivirus systems and firewalls, unless prior approval and consent are obtained from the Cybersecurity Administration.
    • 1-12. The Cybersecurity Department reserves the right to request employees of the University to monitor systems, networks, and personal accounts, and review them periodically to ensure compliance with cybersecurity policies and standards.
    • 1-13. It is prohibited to host individuals who are not authorized to access sensitive areas without obtaining prior approval.
    • 1-14. All visitors are required to wear their identification card throughout all facilities of Najran University.
    • 1-15. Immediate notification to the Cybersecurity Department is required in the event of the loss, theft, or damage of information.
  2. Protecting Assets and Equipment
    • 2-1. It is prohibited to use external storage media (such as USB drives and portable hard drives) without obtaining prior approval from the Cybersecurity Administration.
    • 2-2. It is prohibited from engaging in any activity that affects the efficiency of systems and technical assets, including actions that prevent users from obtaining higher authorities or privileges without prior approval from the Cyber Security Administration.
    • 2-3. The device (your laptop or desktop) must be secured before leaving the office; this involves locking the screen or logging out (Sign out or Lock) at the end of working hours or for short absences.
    • 2-4. Classified information (paper or electronic) must not be left in easily accessible places where unauthorized individuals may view it.
    • 2-5. Installing any external tools (devices or software) on a computer without prior approval from the Cyber Security Administration is prohibited.
    • 2-6. The Cyber Security Administration must be notified immediately upon suspicion of any activity or behavior that could cause damage to university Najran’s computers or technical assets.
  3. Acceptable Use of Network and Software and Internet
    • 3-1. The Cyber Security Administration must be informed when suspicious websites or links are detected; this also applies if work documents relating to functional operations involve risks of infringing intellectual property rights.
    • 3-2. Using any unlicensed software or copyrighted materials (protected by patents, copyrights, or intellectual property rights) without legal authorization is prohibited.
    • 3-3. Only an approved web browser must be used to access the internal network or the Internet; unauthorized browsers are not permitted.
    • 3-4. The use of technologies that allow bypassing the network intermediary (Proxy) or firewall to access the internet, including Virtual Private Network (VPN) software, is prohibited.
    • 3-5. Downloading or installing any software or tools that violate university policies or applicable systems from the university’s internal network or Internet without prior approval from the Cyber Security Administration is prohibited.
    • 3-6. The use of the university's internal network or Internet to download or share unapproved files or media is prohibited.
    • 3-7. Handle emails with caution; and if there is suspicion of a cyber risk (such as a virus or phishing), report to the Cybersecurity Administration immediately.
    • 3-8. Conduct security audits and penetration testing to identify vulnerabilities; this includes conducting tests by licensed external parties after obtaining prior approval from the Cybersecurity Administration.
    • 3-9. The use of file sharing websites or cloud storage services is prohibited without prior approval from the Cybersecurity Administration.
    • 3-10. Visiting suspicious websites related to hacking techniques or consuming illegal substances is prohibited.
  4. Acceptable Use of Email and Communication System
    • 4-1. The university’s email, phone, fax, or electronic fax shall not be used for activities unrelated to work and must comply with cybersecurity policies and standards.
    • 4-2. The exchange of messages containing inappropriate or unacceptable content with internal or external parties is prohibited.
    • 4-3. When sending sensitive information via email, adhere to approved security methods to ensure encryption and protection.
    • 4-4. Do not register the University of Najran’s email address on any website that does not relate to work duties.
    • 4-5. Notify the Cybersecurity Administration immediately upon discovering any content in emails that may cause damage to assets or systems.
    • 4-6. The Cybersecurity Administration reserves the right to examine the contents of university emails to verify that the user has obtained the necessary approvals and complies with established procedures.
    • 4-7. Do not open suspicious or untrusted emails and attachments under any circumstances.
  5. Video and Audio Conferences
    • 5-1. It is prohibited to hold video or audio conferences (Video/Voice conferences) without prior authorization via the internet.
    • 5-2. It is prohibited to make communications or hold meetings using programs or devices not approved by the university for business purposes.
  6. Passwords and Account Security
    • 6-1. Strong and secure passwords must be chosen, and university systems and assets passwords should be kept away from others. University system passwords may not be used to access personal accounts or vice versa.
    • 6-2. The password must be changed for the first time when a new password is provided to the user by the system administrator, and it must be changed periodically according to university policies.