Acceptable Use Policy for Assets

The purpose of the Acceptable Use Policy is to define the acceptable use of all information technology assets at the University, including hardware, software, networks, information, and communication systems in operation.

The scope of this policy covers all systems, devices, employees, and third parties employed directly or indirectly at Prince Musaid bin Abdulrahman University.

User Obligations

• Employees must acknowledge and strictly comply with cybersecurity policies.
• Any security breach, incident, or policy violation must be reported to the Cybersecurity Operations Center.
• Employees are prohibited from disclosing or providing classified confidential information related to the University without approval from the relevant department.
• Employees are prohibited from disclosing or providing confidential information related to the University on social media platforms or websites without approval and authorization from the relevant department and the Cybersecurity Department.
• Equipment must not be removed from its designated location without prior approval from the relevant parties.
• Assets must be used for work purposes only.
• Users are prohibited from engaging in illegal activities or introducing any malicious software or viruses.
• Any loss, damage, or theft of University-owned devices must be reported immediately.
• Employees must participate in cybersecurity initiatives and activities.
• Using another user's password is prohibited.
• Hosting unauthorized individuals in sensitive areas without prior permission is prohibited.
• Employees must display their identification badges in all University facilities and areas.

Computer Use

• University-owned computers must be used for work purposes only.
• The use of removable media is prohibited without prior approval.
• Installing software without prior approval is prohibited.
• Installing illegal or unlicensed software is prohibited.
• Users must log out or lock their devices before leaving the workplace.

Unattended User Devices

• Users are responsible for selecting secure passwords in accordance with the policy.
• Including passwords in email messages is prohibited.
• Users are responsible for any activity associated with their access privileges.
• Shoulder surfing to obtain passwords or decryption keys is prohibited.
• Disclosing passwords to anyone, including employees of the Deanship of E-Learning and Information Technology, is prohibited.
• Writing passwords on paper is prohibited.
• Writing passwords in the presence of others is prohibited.
• The same passwords must not be used for personal accounts and University system accounts.

Password Policy

• Users must comply with the approved Password Policy.
• Temporary passwords must be communicated to users securely.
• Temporary passwords must be changed upon the first login.
• Passwords must not contain personal information.
• Passwords must not contain simple or repetitive patterns.
• Passwords must be complex and must not consist of dictionary words.
• Blank passwords are not permitted.
• Passwords must be changed after the first login or password reset.
• Accounts will be locked for 10 minutes after 5 unsuccessful login attempts.
• Reusing the most recently used password is not permitted.
• The minimum password age is one day.
• Password changes must be enforced at least every 60 days.
• The "Remember Password" feature must not be used unless necessary.

Email Use

• Email must be used for work purposes only.
• Employees are responsible for the appropriate use of email.
• The University reserves the right to monitor email for security purposes.
• Accessing other users' email accounts is prohibited.
• Using personal email accounts to send confidential information without approval is prohibited.
• Using email for illegal activities is prohibited.
• Sending unsolicited messages or spam emails is prohibited.
• Any suspicious email must be reported immediately.
• Caution must be exercised when responding to unknown senders.
• Using official email accounts to join groups unrelated to work is prohibited.
• An email signature must be included.
• Automatic email replies must be activated during leave periods.
• Sending sensitive data without prior approval is prohibited.

Internet Use

• Internet access must be used for work-related activities only.
• Suspicious websites must be reported.
• Downloading unlicensed software is prohibited.
• A secure and up-to-date web browser must be used.
• Using penetration testing tools without approval from the Cybersecurity Department is prohibited.
• Users are responsible for information transmitted over the Internet.
• Publishing confidential information without approval is prohibited.
• Users must comply with applicable laws and regulations in the Kingdom of Saudi Arabia.
• Using social media is prohibited except for authorized work-related purposes.
• The Cybersecurity Department, in coordination with the Deanship of E-Learning and Information Technology, reserves the right to monitor Internet usage, block access to websites, and track user activities.

Mobile Computing and Communications

• Appropriate acceptable use controls must be implemented to protect the network.
• Mobile devices must not be left unattended in public places.
• Processing confidential information in public places or over unsecured networks is prohibited.
• Users are responsible for regularly backing up data.
• It is preferable not to store passwords on mobile devices.
• The loss of any device containing confidential information must be reported immediately.
• Limited temporary accounts must be used for external parties.
• Devices authorized to access the network must be registered and identified.
• All mobile devices must comply with cybersecurity regulations.

Policy Compliance

• The Director of the Cybersecurity Department must ensure periodic compliance with this policy.
• All personnel at Prince Musaid bin Abdulrahman University must comply with this policy.
• Any violation of this policy may subject the offender to disciplinary action in accordance with the procedures adopted by Prince Musaid bin Abdulrahman University.

• National Cybersecurity Authority – Essential Cybersecurity Controls (ECC)
• National Cybersecurity Authority – Cloud Cybersecurity Controls (CCC)
• National Cybersecurity Authority – Critical Systems Cybersecurity Controls (CSCC)
• National Cybersecurity Authority – Social Media Cybersecurity Controls (SMCC)
• National Cybersecurity Authority – Telework Cybersecurity Controls (TCC)
• ISO 27001 Requirements