Mobile Devices and Bring Your Own Device (BYOD) Policy

Objective

To ensure that cybersecurity risks are identified and addressed, and that cybersecurity controls and requirements are implemented to secure mobile devices and employees' personal devices, thereby protecting the data and infrastructure of Prince Musaid bin Abdulrahman University against risks arising from the use of such devices.

Definitions

Term	Definition
Policy	Detailed reference controls and provisions based on regulations issued by relevant regulatory authorities.
Procedure	A document containing a detailed description of the steps necessary to perform specific operations or activities in accordance with relevant standards and policies. Procedures are considered part of operational processes.
Ministry	Ministry of Education.
University	Prince Musaid bin Abdulrahman University.
Authority	National Cybersecurity Authority (NCA).
External Party	Any entity involved in a contractual relationship to provide goods or services, including suppliers and service providers.
Data	Any information, records, statistics, or documents captured, recorded, and stored electronically.
Confidentiality	The protection of sensitive information against unauthorized disclosure.
Mobile Devices	All portable devices, including laptops, smartphones, and tablets, whether owned by the University, employees (BYOD), contractors, or other contracted parties, that can store, transmit, or process sensitive information and are used for work purposes inside or outside University premises.

Responsibilities

Role	Responsibilities
Policy Sponsor and Owner	Director of the Cybersecurity Department.
Policy Review and Updates	Cybersecurity Department.
Policy Implementation and Enforcement	Cybersecurity Department, Deanship of E-Learning and Information Technology, and all personnel at Prince Musaid bin Abdulrahman University.

Scope of work

This policy applies to all mobile devices, whether owned by the University, employees, contractors, or other contracted parties, hereinafter referred to as "all mobile devices", devices", These devices include any equipment capable of storing, transmitting, or processing sensitive information and used for work purposes inside or outside university premises, Such devices include laptops, smartphones, tablets, external storage devices, digital cameras, and similar equipment. These devices are referred to as "personal devices" or "Bring Your Own Device (BYOD)" throughout this policy.

Policy Provisions

Data stored, transmitted, or processed on mobile devices and personal devices are the property of the University. The University reserves the right to control such data even if it does not own the device.
The University shall control mobile devices and BYOD devices subject to monitoring by establishing device profiles, ensuring that unauthorized activities are blocked, separating and encrypting critical business data, and performing device-level scans, among other measures.
Mobile devices shall be managed through a centralized Mobile Device Management (MDM) system.
The University shall monitor the use of mobile devices and BYOD devices by implementing the required controls specified in this policy.
Work-related data and information stored on mobile devices and personal devices shall be securely erased in cases of device loss, theft, or termination of employment contracts.
Access from mobile devices and personal devices to critical and sensitive systems shall be restricted based on business requirements. Such access may only be granted temporarily after conducting a risk assessment and obtaining the necessary approvals from the Cybersecurity Department.
Full-disk encryption shall be implemented on mobile devices and BYOD devices that can access critical and sensitive systems.

Eligibility to Bring Your Own Device

University users shall comply with the Bring Your Own Device (BYOD) Policy when using mobile or personal devices.
University employees may use their personal devices provided that the following conditions are met:
- Obtaining the necessary approvals.
- Obtaining approval from the Cybersecurity Department following an assessment of the associated risks and business requirements for using mobile and personal devices.
- Installing Mobile Device Management (MDM) software.
- Ensuring that antivirus software and all required data security and protection applications are installed.
- Scanning all applications installed on the device.
- Ensuring that the operating system and all software and applications are genuine and properly licensed.

Minimum Requirements for Mobile and Personal Devices

Allow the installation of Mobile Device Management (MDM) software on mobile devices and users' personal devices.
Install and monitor all approved and licensed data security and protection software.
Users authorized to use personal devices shall accept the applicable terms and conditions.
Devices shall be protected with strong passwords, and full-disk encryption shall be implemented on mobile devices that can access critical and sensitive systems.
Mobile devices shall have genuine and properly licensed operating systems.
Operating systems and software shall be regularly updated with the latest security patches and updates, at least once a month.

Acceptable Use of Mobile and Personal Devices

Mobile devices shall not be left unattended when used outside University premises.
When using mobile devices in public places, users shall ensure that unauthorized individuals cannot view or read the displayed data.
Mobile devices shall be protected using strong passwords.
Only genuine and properly licensed software shall be installed on mobile devices.
Mobile Device Management (MDM) software shall be installed on all mobile devices.
Security configurations and updates shall be regularly applied to mobile devices.
Confidential information stored on mobile devices shall be protected in accordance with the Data Classification Policy.
Full-disk encryption shall be implemented on devices containing confidential or highly confidential information.
Before disposing of or selling a mobile device, sensitive information shall be destroyed using techniques that render the information unrecoverable, such as secure erasure, secure wiping, burning, cross-cut shredding, or other appropriate destruction methods.

Secure Disposal Standards Shall Include the Following:

Verifying backups and storage media to ensure that sensitive data and licensed software are securely deleted or replaced before disposal.
Establishing procedures to ensure that all information stored on storage media is erased before disposal or reuse.
Ensuring that the controls implemented for information erasure are appropriate to the classification of the information stored on the media.
Ensuring that all confidential information is destroyed or concealed before sending information system equipment, such as computers or communication devices, to suppliers for handling, servicing, or disposal.

The Following Activities Are Prohibited on Mobile Devices:

Allowing access to any individual other than the employee who owns the device.
Installing unauthorized applications on mobile devices.
Storing illegal materials on the device.
Installing unlicensed software.
Connecting to public or unknown Wi-Fi networks.
Storing sensitive information without encryption.
Transferring University data to unauthorized devices.

Special Rights

Monitor the use of mobile devices at its discretion and in accordance with business requirements.
Prevent mobile devices from connecting to the University network if cybersecurity policies are violated.
Delete University data stored on mobile devices in the following circumstances:
- Loss or theft of the device.
- Expiration or termination of the contractual relationship between the user and the University.

Cybersecurity Violations

All cybersecurity violations involving mobile devices shall be reported immediately to the Cybersecurity Department.

Awareness

Security awareness shall be promoted regarding the appropriate use of devices and users' responsibilities toward them.

Personal Devices

Personal devices running outdated or expired software shall not be permitted to connect to the University network.
Personal devices that do not have the latest anti-malware protection software installed shall be prohibited from connecting to the University network.
Personal devices without Mobile Device Management (MDM) software shall be prohibited from connecting to the University network.

Policy Compliance

The Director of the Cybersecurity Department shall ensure that Prince Musaid bin Abdulrahman University periodically complies with this policy.
All personnel at Prince Musaid bin Abdulrahman University shall comply with this policy.
Any violation of this policy may subject the offender to disciplinary action in accordance with the procedures adopted by Prince Musaid bin Abdulrahman University.

References

National Cybersecurity Authority – Essential Cybersecurity Controls (ECC).
National Cybersecurity Authority – Cloud Cybersecurity Controls (CCC).
National Cybersecurity Authority – Critical Systems Cybersecurity Controls (CSCC).
National Cybersecurity Authority – Telework Cybersecurity Controls (TCC).
National Cybersecurity Authority – Social Media Cybersecurity Controls (SMCC).
National Cybersecurity Authority – Data Cybersecurity Controls (DCC).
ISO/IEC 27001 Requirements.