1. AIM / PURPOSE
The purpose of this Cybersecurity Policy is to establish a comprehensive framework for protecting Alhamd Islamic University's digital infrastructure, information systems, data assets, learning management systems, and technology-enabled educational services from cybersecurity threats, unauthorized access, misuse, disruption, disclosure, alteration, and destruction.
This Policy aims to:
- Protect the confidentiality, integrity, and availability of University information assets.
- Safeguard student, faculty, and institutional data.
- Ensure secure delivery of Open and Distance Learning (ODL) programs.
- Minimize cybersecurity risks and operational disruptions.
- Establish cybersecurity governance and accountability.
- Promote cybersecurity awareness and responsible digital behavior.
- Support business continuity and disaster recovery.
- Ensure compliance with HEC requirements, regulatory obligations, and recognized cybersecurity best practices.
2. SCOPE
This Policy applies to:
- Students.
- Faculty Members.
- Administrative Staff.
- ODL Directorate.
- IT Directorate.
- Researchers.
- Contractors.
- Consultants.
- Third-Party Vendors.
- Service Providers.
- Authorized Users.
The Policy covers:
- Learning Management Systems (LMS).
- University Websites.
- Student Information Systems.
- Email Systems.
- Cloud Services.
- Digital Repositories.
- Data Centers.
- Servers and Networks.
- End-User Devices.
- Mobile Devices.
- Virtual Learning Environments.
- Online Assessment Platforms.
- Communication Systems.
3. DEFINITIONS
Cybersecurity
The protection of systems, networks, applications, and data from cyber threats, unauthorized access, attacks, damage, or disruption.
Information Asset
Any information, system, application, database, device, service, or digital resource owned or managed by the University.
Cybersecurity Incident
Any event that compromises or attempts to compromise the confidentiality, integrity, or availability of information assets.
Access Control
Measures used to regulate and manage access to systems, applications, and information.
Multi-Factor Authentication (MFA)
An authentication mechanism requiring more than one method of identity verification.
Malware
Malicious software designed to disrupt, damage, or gain unauthorized access to systems.
Vulnerability
A weakness that may be exploited by a threat actor.
Data Breach
Unauthorized access, disclosure, alteration, loss, or destruction of information.
4. ROLES AND RESPONSIBILITIES
4.1 Syndicate / Board of Governors
The Syndicate shall:
- Approve cybersecurity governance frameworks.
- Provide oversight regarding institutional cybersecurity risks.
- Review significant cybersecurity reports.
4.2 Rector
The Rector shall:
- Ensure institutional commitment to cybersecurity.
- Allocate adequate resources for cybersecurity initiatives.
- Support risk management and compliance efforts.
4.3 Directorate of Information Technology
The IT Directorate shall:
- Implement cybersecurity controls.
- Monitor systems and networks.
- Conduct vulnerability assessments.
- Manage cybersecurity incidents.
- Maintain security infrastructure.
4.4 Directorate of ODL
The ODL Directorate shall:
- Ensure secure operation of ODL platforms.
- Coordinate cybersecurity awareness initiatives.
- Support compliance within digital learning environments.
4.5 Quality Enhancement Cell (QEC)
The QEC shall:
- Monitor cybersecurity compliance impacting academic quality.
- Review cybersecurity-related risks affecting ODL operations.
4.6 Heads of Departments
Heads of Departments shall:
- Promote compliance within their units.
- Report cybersecurity concerns promptly.
4.7 Faculty and Staff
Faculty and staff shall:
- Follow cybersecurity requirements.
- Protect institutional information.
- Report suspected incidents.
- Complete cybersecurity awareness training.
4.8 Students
Students shall:
- Use systems responsibly.
- Protect account credentials.
- Report security concerns.
- Comply with acceptable use requirements.
4.9 Third-Party Service Providers
Service providers shall:
- Comply with contractual security requirements.
- Protect institutional information.
- Notify the University of Security Incidents affecting University services.
5. COMPLIANCE REQUIREMENTS
5.1 Cybersecurity Governance
The University shall establish a cybersecurity governance framework covering:
- Risk Management.
- Access Control.
- Incident Response.
- Business Continuity.
- Disaster Recovery.
- Data Protection.
- Security Awareness.
5.2 Information Asset Protection
Information assets shall be:
- Identified.
- Classified.
- Protected according to risk levels.
- Periodically reviewed.
5.3 Access Control Requirements
The University shall implement:
- Unique user accounts.
- Role-based access control.
- Least privilege principles.
- Secure authentication mechanisms.
- Password management standards.
- Multi-factor authentication for critical systems where feasible.
Users shall not share credentials with others.
5.4 Network Security
The University shall maintain:
- Secure network architecture.
- Firewalls and filtering controls.
- Network monitoring mechanisms.
- Segmentation of critical systems where appropriate.
5.5 Endpoint Security
University-managed devices shall be protected through:
- Anti-malware solutions.
- Security updates and patching.
- Device configuration standards.
- Encryption where appropriate.
5.6 LMS and ODL Platform Security
The University shall ensure:
- Secure LMS access.
- Regular platform updates.
- Activity monitoring.
- Secure online assessment environments.
- Protection against unauthorized access and tampering.
5.7 Data Protection and Privacy
All users shall comply with the University's Data Protection and Privacy Policy.
Sensitive information shall be protected through appropriate safeguards including:
- Access controls.
- Encryption where applicable.
- Secure storage.
- Secure transmission mechanisms.
5.8 Cybersecurity Awareness and Training
The University shall conduct periodic awareness programs covering:
- Password security.
- Phishing awareness.
- Safe internet usage.
- Data protection.
- Incident reporting procedures.
- LMS security practices.
Training shall be mandatory for relevant users.
5.9 Vulnerability Management
The IT Directorate shall:
- Conduct periodic vulnerability assessments.
- Address identified vulnerabilities.
- Monitor emerging threats.
- Maintain remediation records.
5.10 Incident Reporting and Response
All cybersecurity incidents shall be:
- Reported promptly.
- Documented.
- Investigated.
- Managed through established incident response procedures.
Incident response activities shall include:
- Detection.
- Containment.
- Eradication.
- Recovery.
- Post-incident review.
5.11 Backup and Recovery
The University shall maintain:
- Data backup procedures.
- Recovery mechanisms.
- Periodic backup testing.
- Disaster recovery plans.
5.12 Business Continuity
The University shall establish continuity arrangements to support:
- ODL operations.
- LMS availability.
- Critical academic services.
- Essential administrative functions.
5.13 Third-Party Security Management
Third-party providers shall be subject to:
- Security assessments.
- Contractual security obligations.
- Risk-based monitoring.
5.14 Logging and Monitoring
Appropriate monitoring mechanisms shall be implemented to:
- Detect suspicious activities.
- Investigate incidents.
- Support compliance reviews.
Monitoring shall be conducted in accordance with applicable laws and institutional policies.
6. EXCEPTIONS
Exceptions may be granted only when:
- Operational necessity exists.
- Alternative controls are implemented.
- Risks are formally assessed.
- Approval is granted by the competent authority.
All exceptions shall be documented and periodically reviewed.
7. VIOLATIONS AND CONSEQUENCES
The following actions may constitute violations:
Unauthorized Access
- Accessing systems without authorization.
- Sharing credentials.
- Circumventing security controls.
Improper Use
- Installing unauthorized software.
- Misuse of University resources.
- Unauthorized disclosure of information.
Security Negligence
- Failure to report incidents.
- Failure to comply with security requirements.
Malicious Activities
- Hacking attempts.
- Malware distribution.
- Data theft.
- System disruption.
Consequences
Depending upon severity:
- Counseling.
- Written warning.
- Suspension of system access.
- Disciplinary proceedings.
- Employment sanctions.
- Student disciplinary action.
- Contract termination.
- Legal proceedings where applicable.
8. MONITORING AND REVIEW
The University shall monitor cybersecurity effectiveness through:
- Security audits.
- Vulnerability assessments.
- Risk assessments.
- Incident reviews.
- Compliance monitoring.
- System performance analysis.
Key Performance Indicators (KPIs)
Security Indicators
- Number of cybersecurity incidents.
- Incident response time.
- Vulnerability remediation rate.
- Security audit compliance rate.
ODL Security Indicators
- LMS Availability Rate.
- LMS Security Incident Rate.
- Authentication Success Rate.
- System Recovery Time.
Awareness Indicators
- Training Completion Rate.
- Phishing Awareness Success Rate.
- User Compliance Rate.
Policy Review
This Policy shall be reviewed every two years or earlier due to:
- Changes in HEC requirements.
- Emerging cyber threats.
- Technology changes.
- Regulatory updates.
- Major security incidents.
9. REFERENCES
This Policy shall be read in conjunction with:
- HEC Open and Distance Learning (ODL) Policy.
- HEC Quality Assurance Framework.
- HEC Institutional Performance Evaluation Framework.
- Data Protection and Privacy Policy.
- LMS Usage Policy.
- Information Security Policy.
- Business Continuity and Disaster Recovery Policy.
- Digital Content and Copyright Policy.
- Student Code of Conduct.
- Relevant national cybersecurity regulations and internationally recognized cybersecurity standards and best practices.
10. APPENDICES / ACTION STATUS
A: Cybersecurity Governance Structure
BOG then Rector then IT Directorate then ODL Directorate then Departments then Users
B: Cybersecurity Incident Classification
| Severity Level | Description |
|---|---|
| Critical | Institution-wide service disruption or major data breach |
| High | Significant impact on academic or administrative operations |
| Medium | Limited operational impact |
| Low | Minor security event or policy violation |
C: Cybersecurity Incident Response Lifecycle
Detection then Reporting then Assessment then Containment then Investigation then Recovery then Lessons Learned
D: Minimum Security Controls
- User Authentication
- Access Control
- Password Management
- Backup and Recovery
- Vulnerability Management
- Incident Reporting
- Security Awareness Training
- System Monitoring
- Data Protection Measures
- Third-Party Risk Management
E: Cybersecurity Commitment Statement
Alhamd Islamic University is committed to maintaining a secure, resilient, and trustworthy digital learning environment through effective cybersecurity governance, risk management, awareness, technology safeguards, and continuous improvement to protect institutional assets, support academic excellence, and ensure the uninterrupted delivery of Open and Distance Learning services in accordance with HEC requirements and recognized quality standards.