Reference Document: The National Cybersecurity Council

Release Date: February 2026

 

1. Purpose

The purpose of this policy is to define cybersecurity requirements related to the use of users’ devices (Workstations), mobile devices (Mobile Devices), and Bring Your Own Device (BYOD) in Najran University, to reduce cyber risks to it and protect it from internal and external threats, by focusing on the fundamental protection objectives which are: confidentiality, integrity, and availability of information.

This policy has been aligned with the guidelines and standards issued by the National Cybersecurity Authority and related regulatory and legislative requirements.

2. Scope of Work

This policy covers all users’ devices, mobile devices, and personal devices of employees at Najran University, and applies to all employees (staff and contractors) at Najran University.

General Terms

  • Data and information stored on user devices, mobile devices, and personal devices (BYOD) must be protected according to their classification, using appropriate security controls to restrict access to this information and prevent unauthorized personnel from accessing or viewing it.
  • All user devices and mobile and personal devices (BYOD), including operating systems, software and applications, must be updated with the latest update packages and patches, in accordance with the approved Update and Patch Management Policy of Najran University.
  • Configuration and hardening controls must be applied to user devices, mobile devices, and personal devices (BYOD) in accordance with the approved technical security standards of Najran University.
  • Privileged Access should not be granted to employees on university of Najran systems using mobile devices and personal devices (BYOD), and access privileges should be granted according to the principle of least privilege.
  • Default user accounts in operating systems and applications must be deleted or renamed.
  • Centralized clock synchronization must be provided from a precise and reliable source for all users’ devices, mobile devices, and personal devices (BYOD).
  • User devices and mobile devices should be equipped with a banner to enable authorized usage.
  • Only a specified list of applications (Whitelisting) should be allowed to run on user devices and mobile devices.
  • Data Leakage Prevention technology should be used, along with data protection monitoring systems, to ensure the protection of data on user devices and mobile devices.
  • Important and sensitive media and storage drives on user devices and mobile devices with advanced privileges and access to sensitive systems must be fully encrypted according to the encryption standard approved by university of Najran.
  • The use of external storage media should be restricted in accordance with procedures approved by university of Najran, after obtaining prior approval from the Cyber Security Administration.
  • Mobile devices and personal devices (BYOD) should be centrally managed using a Mobile Device Management (MDM) system.
  • User devices, mobile devices, and personal (BYOD) devices equipped with outdated or expired software are not permitted to connect to the Najran University network to prevent security threats arising from unpatched and unsupported software.
  • Devices belonging to users and mobile devices, as well as personal devices (BYOD) that are not equipped with the latest security software are prohibited from connecting to the Najran University network to prevent cybersecurity risks that could lead to unauthorized access, malware intrusion, or data leakage. Security software includes antivirus and anti-malware programs, host-based firewalls, and advanced intrusion detection/prevention systems for hosts.
  • Deviations from acceptable user behavior should be identified, risk levels assessed, and appropriate mitigation measures developed and/or recommended.
  • User devices and unused mobile devices settings must be configured to display a password-protected session timeout of 5 minutes when the device is not in use.
  • User accounts and mobile devices must be centrally managed via the active directory of Najran University or a central administrative system.
  • Appropriate network policies (Group Policy) must be implemented and applied to all user devices and mobile devices, to ensure configuration settings are properly set, hardened, and in compliance with Najran University’s regulatory and security controls, as well as installing the necessary software configurations.
  • A periodic backup of data stored on user devices and mobile devices must be performed, in accordance with the approved backup policy at Najran University.
  • Technologies enabling remote data deletion and storage on mobile devices and personal devices (BYOD) must be provided and utilized in the following cases:
    • Loss of a mobile device or theft thereof.
    • Termination or end of employment relationship between the user and Najran University.
    • Expiry of usage rights and handover of the mobile device to the concerned administration at Najran University.
  • Remote systems and their information systems must be protected through:
    • Implementation of Secure Session Management, including session reliability (Authenticity), lockdown, and timeout.
    • Application of security updates and patches for remote systems at least once monthly.
    • Reviewing the security settings of remote systems and hardening them at least once annually.
    • Limiting the activation of features and services in remote systems as needed, with a risk analysis of potential cyber threats prior to enabling them.
  • Awareness campaigns on safe mobile device and personal device (BYOD) usage, along with user responsibilities towards them, must be organized in accordance with the approved Acceptable Use Policy at Najran University, and customized awareness sessions should be conducted for users holding important and sensitive authorities.
  • Specific procedures and standards related to the security of user devices, mobile devices, and personal devices must be developed based on business needs.
  • A Key Performance Indicator (KPI) should be used to ensure continuous development, proper and effective utilization of user device, mobile device, and personal device security requirements.

4. Cybersecurity Requirements for User Devices

  • User devices should be assigned to technical staff in critical and sensitive roles, isolated on a private network for system management (Management Network) and not connected to any other network or service.
  • Settings of important and sensitive user devices with advanced privileges (PAWs) should be configured to send logs to the University of Najran’s central logging and cybersecurity monitoring system according to the approved event logging policy and cybersecurity monitoring policy, while preventing users from changing the settings.
  • User devices should be physically secured within buildings of University of Najran and entry/exit operations should be recorded after obtaining necessary approvals in accordance with the University of Najran’s physical security policy.
  • Protection of user devices from viruses, malware, advanced persistent threats, unknown attacks, and other malicious attacks should be ensured through endpoint protection software (Endpoint Protection Software).
  • The integrity of user device data should be guaranteed against alteration, accidental loss, or damage, and its availability and recoverability should be assured.
  • All necessary security controls should be implemented when data is deleted from user devices, especially those connected to cloud services, according to the University of Najran’s Data Protection and Information Security Policy.
  • Updates and patches for devices used to manage sensitive external and internet-connected systems must be managed at least once every month, and at least once every three months for devices used to manage sensitive internal systems, in accordance with the approved change management policy of Najran University.
  • Device configurations used to manage and protect sensitive systems and data must be reviewed and secured at least once every six months.

5. Cybersecurity Requirements for Mobile Devices

  • Access to sensitive systems via mobile devices should be restricted solely for temporary periods, following risk assessments and obtaining the necessary approvals from the Cyber Security Administration.
  • Access of unauthorized users (Device Access Locking) to unmonitored/lost/stolen devices must be restricted.
  • The integrity of information stored on mobile devices (Device Contents Integrity) must be ensured.
  • Device OS and Applications Security: Operating systems and installed applications on mobile devices must be updated and configured appropriately prior to use, in accordance with the technical standards approved by Najran University.
  • Security patches for all mobile devices must be applied at least once per month.
  • Data and information belonging to Najran University stored on mobile devices must be encrypted and disconnected.

6. Cybersecurity Requirements for Personal Devices (BYOD)

  • In the event of employees using their personal devices for work purposes, this must be supported by documented agreements with employees and technical security controls to protect data and information belonging to Najran University.
  • Data and information belonging to Najran University stored on personal devices (BYOD) must be encrypted and disconnected.

Roles and Responsibilities

  • Policy Owner: Cyber Security Management.
  • Reviewing and Updating the Policy: Cyber Security Management.
  • Implementing and Applying the Policy: Digital Transformation Deanship and Knowledge Sources, Cyber Security Management.
  • Measuring Compliance with the Policy: Cyber Security Management.

8. Updates and Reviews

The Cyber Security Management should review the policy at least annually, or in case of any changes in policies or regulatory procedures at Najran University, or relevant legislative and regulatory requirements.

9. Policy Compliance

  • The Cyber Security Management shall ensure that Najran University complies with this policy periodically.
  • All employees of Najran University shall comply with this policy.
  • Any violation of this policy may subject the offender to disciplinary action according to the procedures followed at Najran University.