I.5 — Compliance Policy

Document Control Information

Policy Code

I.5

Standard

I. Legal Compliance and Public Disclosure

Status

published

Version

1

Process Owner

Legal Council

Prepared By

Legal Council

Reviewed By

QAIE

BOT Approval

approved

First Issue Date

22 Sept 2023

Last Review Date

12 Jun 2024

Relevant To

DMU Stakeholders

Used With

—

Modification History

Purpose and Scope

Abbreviations and Definitions

Policy Statement

1. The Organization’s management shall put in place reasonable systems and controls to ensure that all the organizational records and the employee personal information are adequately protected from loss, destruction, and falsification.
2. Users are to ensure that any records in their custody are protected from loss, destruction, and falsification.
3. Documents shall be made identifiable and kept in safe custody in such a way that potential damage is minimized.
4. The documents’ retention shall be based on regulatory requirements and business needs.
5. Measures shall be put in place to safeguard against the loss of records/data due to future technological changes.
6. Records not covered under statutory law shall have their retention attributes.
7. All the Management System (MS) documentation at the Organization must follow the procedure for retention of records.

1. All relevant statutory, regulatory, and contractual requirements shall be identified.
2. All specific system requirements and control shall be identified.
3. The Legal Department shall ensure that adequate clauses in relation to Information Security and educational operations are considered in contracts prepared for the Organization. The contractual clauses shall include the following minimum controls:
4.  Non-disclosure statements
5. The Organization’s right to audit and conduct compliance checks (as applicable); and
6. On the use, ownership, license terms and details of the Organization and/or third party owned Intellectual Property rights.
7. The compliance policy shall be updated with relevant changes in the business environment (i.e., change of governance structure, laws, etc.).
8. The Legal Department shall advise the IT of all new and modified regulatory requirements to which they must comply.

1. Users at the Organization shall recognize Intellectual Property (IP) rights associated with information and information systems by:
2. Ensuring that they do not download or install any unauthorized software on:
3. their workstations; and/or
4. any other devices (such as laptops, mobile phones, tablets, handheld devices, and other hardware) provided by the Organization, which is not expressly authorized or approved by the Organization.
5. Only using licensed software within the scope of the license and complying with all license terms relating to the same.
6. Not copying or reproducing (whether in whole or in part) any books, articles, music, movies, designs, and/or any other literary, artistic, educational, or musical works protected by copyright law unless expressly authorized by the relevant copyright owner or licensor.
7. Understanding what (if any) Intellectual Property may be utilized and/or created when engaging a third party and what rights the Organization may need to secure.
8. Understanding what (if any) foreground Intellectual Property may need to be formally protected by registration (e.g., trademarks, patents, etc.).
9. The following principles should be complied with in order protect any material that may be considered Intellectual Property:
10. Acquiring software only through known, reputable, and authorized sources.
11. Only using software in accordance with the software license terms and scope (e.g. use of software only within the permitted use, not using software in excess of the quantity licensed, not allowing unlicensed third parties use of the software, not continuing to use software after expiry of the software license, etc.).
12. Maintaining proof and evidence of a right to use the relevant software (including maintaining renewals of relevant software licenses).
13. Carrying out regular checks that only authorized and licensed software is installed.
14. Maintaining an inventory of Intellectual Property owned or licensed by the Organization and identifying the requirements to protect it.
15. Not using any of the Organization’s name, brand names, logos, taglines, slogans, or other trademarks without written permission from the Organization.
16. Engaging the Legal Department to ensure that contract agreements address Intellectual Property requirements.
17. In the event of any claim (actual or alleged) by a third party relating to:
18. breach of software license; or Intellectual Property infringement, users engage the Legal Department as soon as possible.

Policy Statement — Continued

1. Awareness sessions shall be conducted among all employees on Intellectual Property rights and software licensing.
2. The data retention period of the Organization’s data shall be established to meet legal and business requirements.
3. The archiving of documents shall take place with due considerations for legal, regulatory, and business issues with liaison between Legal Affairs, technical and business staff.
4. The Organization as far as it affects its business activities shall comply with the requirements of applicable data protection legislation.
5. The Organization shall reserve its rights to access data/information in employee’s information systems.
6. Personnel using the Organization’s information systems shall be prohibited from gaining unauthorized access to any other information systems, or in any way damage, alter, or disrupt the operations of these systems. This shall also include capturing or obtaining passwords, encryption keys, or any other access control mechanism, which shall permit unauthorized access.
7. The Organization’s personnel shall not acquire, hold, trade, and use hardware or software tools that could be employed to evaluate or compromise security of corporate information systems.
8. The IT Department shall ensure that proper information security controls are implemented to comply with statutory and regulatory requirements applicable to the Organization.

1. Domain names registered under the Organization shall be protected and always secured.
2. Unauthorized software shall not be permitted to be installed on the Organization’s systems.
3. Wherever appropriate, sensitive, or confidential information or data shall be transmitted in encrypted form. Prior to transmission, consideration must always be given to the procedure to be used between the sender and recipient parties and any possible legal issues from using encryption techniques.
4. Cryptographic controls (with legal and regulatory requirements) shall be implemented as and when required and applicable.
5. Technical compliance (e.g., vulnerability assessment, penetration testing, application security testing, etc.) shall be performed as and when required and as per schedule.

1. MS Internal Audit shall be conducted on a periodic basis to ensure compliance requirements are adhered to in respective departments.
2. The Organization may also perform service provider or vendor audits if required as set out in the relevant contract.

1. The ownership of information security policies and procedures is defined within the Information Security Governance roles and responsibilities.
2. Quality Assurance and Institutional Effectiveness department shall ensure that all security policies and MS procedures are reviewed annually or when changes are required for adequacy and continued appropriateness.
3. All employees are required to fully comply with the Organization’s policies and procedures.
4. Any Information Security incidents resulting from non-compliance shall result in disciplinary action.
5. MS Internal Audit shall be performed as per MS Internal Audit Procedure.

Responsibilities for Application

• Process Owner should follow all the regulations in place and report to necessary authorities if they come across non-compliance.
• The Vice Chancellor Academic Affairs & Support Services, Deans of Colleges, Associate Deans, Heads Department /Chairs, and ensure all regulations are implemented and action is taken if noncompliance occurs. IT to support the IT set up to ensure system security is managed effectively.
• Quality Assurance and Institutional Effectiveness department ensures the effectiveness of the implemented controls and avoids any potential violations and/or breaches of any laws and/or regulations, contractual terms and/or internal policies.