Laws and legislation

Sixth Axis:

Electronic Policies and Regulations at the University of Fallujah

Introduction
Electronic website management policies and regulations are fundamental documents that outline work frameworks, define roles and responsibilities, and specify the correct practices to be observed and implemented by website administrators affiliated with the University of Fallujah, regardless of their authorities, to achieve the security and safety of electronic websites.

Note: The policies and regulations of the University of Fallujah do not conflict with the Information and Data Security Policies and Standards Document issued by the General Secretariat of the Council of Ministers (but rather complement it).

Objective:
Providing a secure, reliable, and smooth information systems environment to ensure optimal use of electronic website management, where all website administrators (according to their granted authorities) within the university bear responsibility for correct and secure usage through establishing controls and instructions that clarify acceptable and prohibited practices and protect the system from unauthorized access.

Scope:
All website administrators with various authorities

- General Controls

• a. The official university email account must be used in website management accounts.
• b. It is not permitted to disclose the password or allow others to use it, with the necessity of maintaining the confidentiality of information within the system, and the violator bears the legal consequences.
• c. There are four types of accounts that differ in roles or authorities for managing the electronic website, which are:
  1. System administrator account and electronic website management system work team (Super admin): The owner of this account has absolute authority to access all electronic websites affiliated with the University of Baghdad and is determined by the system administrator with an official letter.
  2. Website administrator account (Administrator): A unique account whose owner is responsible for the website unit in colleges, institutes, or centers, or the website administrator in university presidency departments, where the owner of this account has semi-absolute authorities that allow them to manage their site.
  3. Editor account within the support team (Editor): The owner of this account has lower authorities than the website administrator account.
  4. Author account within the support team (Author): The owner of this account only has the authority to add and modify news.
• Use a unique, hard-to-guess password that is not sequential, sufficiently long, and composed of letters, numbers, and symbols without repetition, with consideration to changing it periodically and not using it in more than one account or login system.
• Password resets are the responsibility of the electronic website management system work team in the website subdivision and are done in case of forgetting or losing the password used by the user, after submitting a request from the account owner through the technical support system.
• The information security manager has the right to propose any technical security additions to the system administrator for the public interest and ensuring the security of electronic websites.
• There should not be two or more accounts of the website administrator category in one formation, and the website unit official or the person assigned to manage it is the sole owner of this account.
• Necessity may require reviewing login records (logs) by the system administrator.
  1. The formation may submit an official letter addressed to the website subdivision to create an electronic website with a subdomain within the University of Fallujah domain for conferences held within the formations, and its management is either through the website subdivision by adding a member from the subdivision staff within the conference committees, or through nominating a name from the formation staff with the necessity of providing their complete information.
  2. In case of changing the website administrator, there must be an official handover in the formation for the accounts between the previous and current administrator, and the website subdivision must be notified with an official letter including the complete information of the new administrator (full name in Arabic, full name in English, official university account, phone number).
  3. The website subdivision determines the authority levels mentioned in paragraph (Third - c) as it deems appropriate from the technical and security perspective.
  4. All accounts with various authorities have the right to use the technical support system for technical inquiries or to modify website management accounts (except for the website administrator account).