Security Policies Incident Response Plans

Document Security Policy

Purpose

The purpose of this policy is to ensure the protection of the documents, especially the sensitive once, at the UTAS-Sur from unauthorized access, theft, or damage.

Scope of the Policy

This policy applies to all members of UTAS-Sur, whether on a temporary or permanent basis as well as any third parties working with or contracted by the university, it covers all environments where the university’s information systems are operated.  

Executive Responsibility

Information Systems and Educational Technologies Center.

Policy Custodian

‏Assistant Vice Chancellor for UTAS – Sur.

Enforcement

Any violation of this policy by all members or third parties (suppliers, contractors, business partners, etc.) will be subject to disciplinary and legal actions in accordance with the laws of the Sultanate of Oman, including regulations related to cybersecurity, university’s policies, labor laws, and electronic transactions. 

Policies and Controls

  • UTAS-Sur must classify its documents to ensure the protection of sensitive information and prevent misuse. Documents should be categorized under one of the following classifications: 

– Public: Information that is publicly available, such as content published on the internet. 

– Confidential: Information that is available to specific university groups, such as internal reports and directories. 

– Highly Confidential: Sensitive information with restricted distribution, such as contracts and official university documents. 

– Top Secret (if applicable): Information that, if disclosed, could severely impact national security or university operations. These documents must be labeled appropriately. 

  • Sensitive or important documents should be stored in locked locations, preferably in fire-resistant cabinets, and must be securely disposed of when no longer needed. 
  • Only permanent UTAS-Sur employees with proper authorization may handle, copy, or scan highly classified documents. Temporary employees and external parties should not have access to such materials. 
  • The university must implement mechanisms to ensure that all classified documents are properly labeled and secured. 

Effective Date of the Policy

This policy shall take effect from the approval date.