Terms of Use Policy

Passwords must not be shared with any other party.
Passwords must not be recorded or written down in any form.
Users must use work passwords that are different from those used for personal accounts.
Passwords must be changed immediately if there are any indications that they have been compromised or leaked.
Passwords must always be changed upon the first login.
Passwords must consist of at least 8 characters and include uppercase and lowercase letters, numbers, and symbols.
Users must not share access to university systems with anyone else.
Users must not allow anyone to enter non-public facilities using their access credentials or cards, or by following them into such areas.
Any suspicious activity on accounts must be reported immediately to the Technical Support Team.

Acceptable Use Policy

1. Acceptable Use of Access Accounts

Passwords must not be shared with any other party.
Passwords must not be recorded or written down in any form.
Users must use work passwords that are different from those used for personal accounts.
Passwords must be changed immediately if there are any indications that they have been compromised or leaked.
Passwords must always be changed upon the first login.
Passwords must consist of at least 8 characters and include uppercase and lowercase letters, numbers, and symbols.
Users must not share access to University systems with anyone else.
Users must not allow anyone to enter non-public facilities using their access credentials or cards, or by following them into such areas.
Any suspicious activity on accounts must be reported immediately to the Technical Support Team.

2. Acceptable Use of Messaging Systems

Email services must be used only for work-related or educational purposes.
University email must not be used for non-work-related purposes, such as blogs and forums.
Suspicious attachments or links in emails must not be opened and must be reported immediately to the Technical Support Team.
Personal email accounts must not be used to share University data.
Messaging services provided by the University must be used only for work-related communications.
Highly confidential data must not be sent through email or instant messaging systems.
Confidential data must be encrypted, for example, by password protection, when sent to external email addresses (addresses not affiliated with the University).
When sending confidential data by fax, the recipient must be notified in advance, and confirmation of receipt must be requested.
When sending confidential data by email, the word "Confidential" must be included in the email subject line or body.

3. Acceptable Use of Internet and Network Services

University Internet services must not be used to view or download inappropriate or offensive materials, such as games, suspicious websites, or copyrighted materials.
University Internet services must not be used to attempt unauthorized access to any external system.
While on University premises, users must use only the Internet services provided by the Deanship of Information Technology.
When outside University premises, users must use only trusted Internet services.
When connecting to the Virtual Private Network (VPN) services provided by the University, users must ensure that their devices have anti-malware software installed and updated operating systems.

4. Acceptable Use of Desktop Devices

Screens must be locked when devices are left unattended.
Users must not attempt to install any software or hardware without obtaining approval from the Deanship of Information Technology.
Users must not modify device security settings, such as lockout policies, firewalls, antivirus software, and similar settings.
Devices must be positioned to minimize the possibility of other individuals viewing their screens during use.
Any suspicious activity or malfunction in security software, such as antivirus software, must be reported immediately to the Technical Support Team.

5. Acceptable Use of Encryption

Work-related data must not be encrypted unless required by this policy or unless formal approval has been obtained from the Data Owner and the Deanship of Information Technology.
Work-related data may only be encrypted using encryption software provided by the Deanship of Information Technology.
Upon termination of employment or transfer to another position within the University, users must ensure that all encryption keys under their management are handed over to their direct supervisors.

6. Acceptable Use of Social Media

Accounts representing the University must not be created on social media platforms without formal approval from the General Department of Media and Communication.
Users must not officially publish any information related to the University on social media accounts.
Any suspicious activity detected on the University's social media accounts, such as account compromise or leakage of sensitive data, must be reported immediately to the Technical Support Team.

7. Acceptable Use of Data and Storage Media

Highly confidential data must only be stored in lockable offices or centralized storage or archiving facilities. Data that is not highly confidential may also be stored in office cabinets and drawers.
Highly confidential or confidential data must be encrypted using tools provided by the Deanship of Information Technology when stored on removable or portable storage media and must be deleted immediately after use.
Storage media containing highly confidential data must not be connected to devices that have not been issued and managed by the University.
Storage media must not be left unattended in public or open areas, such as desktops, printers, fax machines, vehicles, and similar locations.
Cabinets, drawers, and offices must be locked when left unattended if they contain non-public data or storage media.
Highly confidential or confidential data accessible to a user must not be shared with other users without the knowledge and approval of the Data Owner.
Highly confidential, confidential, or restricted data accessible to a user must not be shared with external parties without written approval from the Data Owner.
Data must not be published or shared publicly without obtaining written approval from the Data Owner.
Highly confidential or confidential data must not be exported from business applications without written approval from the Data Owner.
The data classification must be included in the document footer or filename for non-editable documents, along with the name of the Data Owner, at least for highly confidential and confidential data, in documents containing highly confidential, confidential, or public data.
Physical transportation of media containing confidential data must be carried out either by officially authorized University employees or approved courier services.
Storage media containing non-public data must be securely erased using tools provided by the Deanship of Information Technology before being reused by another user.
Paper documents containing non-public data must be shredded when no longer needed.
The loss of any storage media containing highly confidential or confidential data must be reported to the Technical Support Team within two days.

8. Acceptable Use of Mobile and Personal Devices

Personal devices must not be connected to the University's internal wired or wireless networks, except for the guest wireless network.
Personal devices must be protected using biometric authentication, such as fingerprint recognition. If this feature is unavailable, passwords or patterns must be used.
Software must only be installed from official and trusted application stores.
Personal device settings must be configured to automatically update all software and operating systems.
Personal device settings must be configured to lock the device after five minutes or less of inactivity.
Only personal devices running iOS, Android, or Windows operating systems may be used.
Personal devices must not be shared with anyone else unless the device supports the creation of separate user profiles or isolated workspaces.
Highly confidential data must not be stored on mobile or personal devices.
When users are in public or open areas, they must always keep their mobile devices with them.
Mobile devices must not be left unattended in offices unless they are locked and secured to an immovable object, such as with security cables.
Devices must not be left in vehicles when users exit the vehicle.
University-issued mobile devices must not be shared with anyone else.
The University reserves the right to remotely erase the contents of personal devices if they are stolen, lost, or compromised.
The University reserves the right to suspend access to any service if suspicious behavior is suspected, until the incident has been investigated and resolved.
The loss or theft of any mobile or personal device must be reported to the Technical Support Team within two days.
Any suspected compromise of a mobile or personal device must be reported to the Technical Support Team within two hours.
Users must immediately notify the Technical Support Team if a device previously reported as lost is found, to avoid erasing the device's contents and resetting passwords, where possible.

9. Right to Monitor User Activities

The University reserves the right to monitor user activities on systems and services provided by the University to the extent necessary to ensure the protection of university systems and data, while respecting users' privacy whenever possible.

10. Responsibility for Reporting Incidents and Vulnerabilities

Users must immediately report to the Technical Support Team any events suspected of adversely affecting the confidentiality, integrity, or availability of systems or data, such as system breaches, data leaks, or receipt of phishing emails.
Users must immediately report to the Technical Support Team any security vulnerabilities discovered in the systems or services they use, such as the ability to access data they are not authorized to access.

Last update: 13/10/2026 - 13:11