End User Computing Policy
End User Computing Policy
End User Computing Policy
POLICY DOCUMENT
This document is the proprietary and exclusive property of Balsharaf Group. No part of this document, in whole or in part, may be reproduced,
stored, transmitted, or used for design purposes without the written permission of Balsharaf Group.
The information contained in this document is subject to change without notice. You can get latest version from HR Portal www.balsharaf.com.sa
or from Balsharaf IT’s File server in Primary Data center \\riy-ho-fs.balsharafgroup.loc\IT End User Policies
REVIEW COMMITEE
The following IT staff is involved in the review of this document:
DOCUMENT APPROVAL
While the following signatories are the initial approvers of this document, any future updates will be done
electronically via HR Portal and file server.
Cell #: +966 549 106 569 Cell :# +966 549 106 570
Signature: Signature:
Page 2 of 17
CONTENTS
REVIEW COMMITEE __________________________________________________________________________ 2
DOCUMENT APPROVAL _______________________________________________________________________ 2
1. Introduction __________________________________________________________________________ 4
Purpose of Document 4
Scope 4
Exclusions 4
Audience 4
2. IT services and Hardware ______________________________________________________________ 5
How does this affect YOU? 6
Getting IT asset/service: 6
Replacement of IT Assets: 7
IT asset Inventory: 7
Returning IT Asset/service/ cancellation of an IT service: 7
Shared services: 7
3. information security Policy _____________________________________________________________ 8
Overview: 8
Purpose: 8
Scope: 8
Policy: 8
Your Work Area 9
Backups 10
4. Email Policy _________________________________________________________________________ 10
Scope: 10
Policy: 10
5. Password Policy _____________________________________________________________________ 11
Purpose: 11
Scope: 12
Policy: 12
6. Printer Policy ________________________________________________________________________ 13
10.1 Purpose: 13
Scope 13
Policy 13
7. Anti-Virus Policy _____________________________________________________________________ 14
11.1 Purpose: 14
Scope: 14
Policy: 14
8. internet Policy _______________________________________________________________________ 15
How does this affect you? 15
9. Breach _____________________________________________________________________________ 16
10. Exemption __________________________________________________________________________ 16
11. Appendix ___________________________________________________________________________ 16
Page 3 of 17
1. INTRODUCTION
I.T. Procedure & Policy is vitally important for our organization, and it is not difficult to follow. This
document provides the framework for the deployment, use, support, maintenance and
decommissioning of computing devices and IT related services within the Company.
The simple actions and procedures described in this document will help you to comply with Balsharaf
IT Procedure & Policies. As an IT user, you must understand them and put them into regular practice.
If you have any doubts about what’s expected of you, please contact IT help desk:
Email: ithelpdesk@balsharafgroup.com
Finally, if you have any suggestions for improving Information Security, or if you come across a
situation which you think puts our information at risk, report it to Balsharaf ‘s IT Help desk.
PURPOSE OF DOCUMENT
This policy is to define the policy principles to manage the IT Assets and IT service and the security
threat that these may pose to the company.
SCOPE
This standard applies to the devices that have the capability of processing and/or storing data that
may be retrieved and/or transferred to other devices located within the company’s IT infrastructure
or external to the company’s IT infrastructure
This policy addresses the actions that must be taken by all personnel who have any IT related
service/s and/or devices issued to them, or who happen to have Company devices under their custody,
care or control or who are using a Company device or who make use of devices that has been
entrusted to the Company by a client or vendor.
EXCLUSIONS
This policy does not apply to non employees who make use of their own hardware and software and
do not connect physically to the Local Area Network (LAN), however, if a non- employee is issued with
our IT asset, this policy shall apply.
AUDIENCE
Page 4 of 17
This policy applies to all permanent and temporary staff within the Company and contractors and
visitors who work and/or visit the Company. This policy applies to the Company’s subsidiary
companies and their employees, including temporary staff, contractors, consultants, third parties and
service providers utilizing the Company’s information resources.
Page 5 of 17
HOW DOES THIS AFFECT YOU?
Any company asset assigned to you means that you are fully accountable for the asset and the
information stored in the Asset while it is assigned to your name and you can be held financially
accountable in the event that the asset and/or information is lost, stolen or damaged.
GETTING IT ASSET/SERVICE:
All IT equipments including PCs, printers, USB drives etc. and IT services like email, internet or
applications are provided to users based on the nature of work that user do and specific approval from
his department head. Please refer to “IT Services Catalogue” for more details on what IT services are
available (appendix on page 18)
• If service or IT asset is for a new user then there is a form that needs to be completed and
signed by the department head. Along with the services requested user also gets an account in
IT Helpdesk system using which he can ask for support going forward.
• For users that already exist in the system – IT Helpdesk should be contacted with the details of
service/asset needed.
• Please note that ALL USER REQUESTS should be through IT Helpdesk system, IT Staff will NOT
allocate their time on any request for which IT helpdesk ticket don’t exists.
o IT Helpdesk tickets can be easily created by either calling the service desk with the
details of the request.
o By sending email to IT Helpdesk – system will send you a return email automatically
with ticket number and register your request (Please refer to document “Policies &
Procedure – Incident & Problem Management” for details on the process. Latest
Page 6 of 17
copy of the document can be obtained from Balsharaf IT File server or HR portal
www.balsharaf.com.sa )
• In order to ascertain proper identity and nature of work and to ensure system security, please
note that IT services or assets cannot be provided to people who DO NOT EXISTS in HR
records. Employee HR number is a must for requesting and service from IT.
• Once there is an approval from business side (either through the form or IT Helpdesk), request
is evaluated by IT and proper configuration/access is determined based on the nature of work,
IT standards, compatibility with software and compliance to IT policies and it goes for CIO’s
approval who may approve, reject or suggest changes in the request.
REPLACEMENT OF IT ASSETS:
As a policy, IT assets are not replaced before 4 years of utilization unless and until there are strong
reasons to support the change and change is approved by CIO as an exception.
IT ASSET INVENTORY:
All users’ IT equipments are maintained in the IT Asset inventory by IT personnel. Each employee is
responsible for taking reasonable safety precautions. Employees will be held responsible for damage
to such equipment arising out of their negligence or intentional misconduct.
IT Clearance is needed whenever employee is leaving the company, being transferred or going for
vacation. HR will look for this clearance before making any settlement to the employee. It is your
responsibility to ensure that the Asset Transfer is completed in the event that you move to a different
cost centre or terminate your employment.
SHARED SERVICES:
The Company provides networking printer for workgroup. Individual printers are not normally
provided except for special cases, same applies to internet, copier, fax or scanners.
Page 7 of 17
3. INFORMATION SECURITY POLICY
OVERVIEW:
This policy is intended to protect the employees as well as the Company from the consequences of
illegal or damaging actions by individuals using the Company Information Technology Network.
The Company Information Technology Network includes: Internet, Networking equipment, Software,
Operating Systems, storage media, Network accounts providing Email, which are the property of the
Company. They are to be used for business purposes and to serve the interests of the Company, and as
well as all Authorized Users.
Effective computer Security is a team effort requiring the participation and support of every member,
employee, and Authorized User who deals with information and/or information systems. It is the
responsibility of every computer user to know the Company Information Technology Policies and
Procedures, and to comply with the Company Information Technology Policies and Procedures.
PURPOSE:
This policy describes the Authorized Use of the Company Information Technology Network and
protects the Company and Authorized Users. Unauthorized uses expose the Company to many risks
including legal liability, Virus attacks, and the compromise of Network systems, Services, and
information.
SCOPE:
This policy applies to all persons with a company-owned, third party-owned, or personally-owned
computing device that is connected to the Information Technology Network.
POLICY:
• Usage of IT Assets: IT Assets may not be used for personal use or used to store private
information.
o The company reserves the right to monitor all information stored on company assets
and remove the information.
Page 8 of 17
o Company IT assets may not be used to create, send, receive or store materials that
infringe the copyright or other intellectual property right of any third parties.
o The following elicit or offensive information may not be stored on company assets:
Pornography in any shape nature or form
Socially unacceptable language, terminology or reference
Biased or offensive reference to religion, social standing, sex or ethnicity
• Personal Information: Saving personal information on a company supplied computer is done
at your own risk as the information may be removed and will not be recovered in the event of a
computer failure.
• Destruction of information: Company Information may not be willfully destroyed from IT
system data storage devices unless the destruction has been intentionally planned and
approved by the Information Owner.
• Request Access to Information: Users may only be granted access to information if
permission has been granted by the information owner.
• Automatic Time-outs: The screen savers will be activated after fifteen (15) minutes, user
need to enter password to unlock.
• Removing Logical Access: HR will send clearance form for IT’s approval for each employee
that is leaving the company or being transferred, which in turn invokes set of IT processes to
verify and remove the user access with each IT Division (Systems, SAP, Networks, HHT, Retail).
There is an internal IT form for the process that is rotated to each IT Division head for his
action and signoff before IT clearance can be given to HR for the employee.
• User Responsibility: Users may not disclose their password to anyone. Users will be held
responsible for all activities performed with their personal system user IDs.
• Password Standard: Complex passwords shall be required to login and access IT systems.
Choose a password of at least eight characters, using upper and lower case letters, numbers
and punctuation marks as in the Example : 1Like!t0 (Do not use this example as your
password).
o Passwords shall expire after N (30, 28, 45 or 60) days based on application.
o User accounts shall automatically be locked out after N numbers (3, 5, 10 based on the
application and kind of security needed) of failed login attempts.
• Security Monitoring: User accounts and access to information shall be monitored and any
violations shall be reported.
• Anti-virus and Patch Management: Only computers that comply with the company standards
may connect to the Local Area Network (LAN). Users may not remove the company installed
Anti-virus software or stop the software from working. Users may not resist/prevent software
patches being installed by Balsharaf IT.
• Archiving: The company shall archive information electronically as deemed necessary
indefinitely, and reserves the right to monitor and review archived information
• Always use your computer lock, power-on password when you leave the machine
unattended.
• Lock away portable items such as External HDD, Flash memory when you are not using
them
• When viewing sensitive information, position your computer screen so it can’t be
overlooked.
• Keep food, liquids and cigarettes away from computer
• Don’t keep computer and related equipments in areas susceptible to damp, vibration,
dirt, chemicals or an unreliable power supply.
BACKUPS
Backing up your work is the only way of making sure it can be retrieved in the event of a disk crash or
other computer problem.
4. EMAIL POLICY
Authorized Users use the Email within the scope of Company Information Technology Email policies.
SCOPE:
This policy covers appropriate use of any electronic message sent from a Company account, and
applies to all Authorized Users of the Company Information Technology Network.
POLICY:
The Email systems are intended for use in the conduct of Balsharaf business. All Email messages will
be considered as Balsharaf records. The company retains all rights to read the contents of any message
sent from the Balsharaf network.
Page 10 of 17
• Unauthorized use of e-mail will include, but is not limited to Soliciting for political, personal,
religious or charitable causes or other commercial ventures outside the scope of the user’s
employment and the user’s responsibilities to Balsharaf, Spamming, Letter bombing and
copyright infringement
• Sending, transmitting or distributing proprietary information, data or other confidential
Balsharaf information may not be sent to unauthorized recipients.
• No advertisement, Internet home page, electronic bulletin board posting, electronic mail
message, voice mail message, or any other public representation about Balsharaf may be
issued unless it has first been approved
• There should be limited personal usage of Balsharaf email system and it should not
compromise its official usage.
• No elicit or offensive information may be transferred via any Balsharaf enabled means of
electronic communication.
• Individuals who receive any electronic communications with objectionable content should
report the matter to their supervisor or to IT personnel immediately.
• No sensitive information may be transmitted without prior approval.
• Please make sure that you use email service for yourself ONLY and no ONE except you should
write emails from your login. You will be held responsible from whatever is sent using your
email ID.
• Basic etiquette needs to be followed when communicating with any party.
• Balsharaf reserves the right to restrict access to electronic communication methods such as
Skype, MSN etc.
• Sending Chain Email or joke Emails from a Company Email account is prohibited. These
restrictions also apply to the forwarding of Email received by an Authorized User.
• Do not use company email ID for registering yourself on websites that are not covered under
company’s scope of work.
5. PASSWORD POLICY
Passwords are essential to computer Security. They are the front line of protection for Authorized User
accounts. A poorly chosen password can result in the compromise of the entire Company Information
Technology Network. All Authorized Users are responsible for taking the actions outlined below, to
select and secure their passwords.
PURPOSE:
Page 11 of 17
The purpose of this policy is to establish a standard for creation and protection of strong passwords
for Authorized Users of information technology resources on the Company Information Technology
Network. This policy will also establish the frequency of change for those passwords.
SCOPE:
The scope of this policy includes all Authorized Users who are responsible for an account (or any form
of access that supports or requires a password) on any system that resides at any Company facility,
accesses the Company Information Technology Network.
POLICY:
All user-level passwords (e.g. Email, Application, desktop computer, etc.) must be changed at least
every N days based on the kind of security needed (28 for SAP, 30 for AD or email, 60, 90). All user-
level and system-level passwords must conform to the guidelines described as per below Standards
• The password contains both upper & lower case (e.g. a-z, A-Z)
• The password has digits and punctuation characters as well as letters (e.g. 0-9,
!@#$%^&*()_+|~-=\`{}[]:";'<>?,./)
• The password is at least eight alpha-numeric characters long
• Based on the level of security needed you will NOT be allowed to repeat last N number
of password used earlier.
• The password is not based on personal information, family name, etc.
Page 12 of 17
co-workers, on questionnaires or to family members. If someone demands a password,
they should be referred to this document or they should call I.T.
• If an account or password is suspected to be compromised, the incident must be
reported to I.T. personnel and the password must be changed immediately.
• Activate a screensaver with password, or log off before leaving your computer
unattended
• Use different passwords for the Internet and other systems
6. PRINTER POLICY
10.1 PURPOSE:
Printers represent one of the highest equipment expenditures at our company. The goal of this policy
is to facilitate the appropriate and responsible business use of printer assets, as well as control printer
cost of ownership by preventing the waste of paper, toner, ink, and so on.
SCOPE
POLICY
• Installation of personal printers is generally not condoned at company due to the cost
of maintaining and supporting many dispersed machines. In certain circumstances,
however, where confidentiality, the need to print a large number of low volume print
jobs, or other unusual situation is an issue, personal printers may be allowed.
• Make efforts to limit toner use by selecting light toner and lower dpi default print
settings.
• Avoid re-using paper in laser printers, as this can lead to paper jams and other
problems with the machine.
• Color printing is typically not required by general business users, thus color printers
are granted as an exception provided backed by strong need.
Page 13 of 17
• Do not use the printer for personal purpose, it can cause you financial penalties
• Ensure that you contact IT Helpdesk for replacing toners, cartilages. Doing it on your
own can cause you financial penalties.
• If you encounter a physical problem with the printer (paper jam, out of toner, etc.) and
are not trained in how to fix the problem, please do not try. Instead, report the problem
to IT or ask a trained co-worker for help.
7. ANTI-VIRUS POLICY
11.1 PURPOSE:
A virus is a piece of potentially malicious programming code that will cause some unexpected or
undesirable event. Viruses can be transmitted via e-mail or instant messaging attachments,
downloadable Internet files, diskettes, CDs and Flash-Memory. A virus infection can be very costly to
company in terms of lost data, lost staff productivity, and/or lost reputation. The purpose of this policy
is to provide instructions on measures that must be taken by employees to help achieve effective virus
detection and prevention.
SCOPE:
This policy applies to all computers that are connected to the network via a standard network
connection or wireless connection. This includes both company-owned computers and personally
owned computers attached to the network. The definition of computers includes desktop
workstations, laptop computers, handheld computing devices, and servers.
POLICY:
Balsharaf IT environment currently runs on Kaspersky anti-virus software. All computers attached to
the company network must have standard, supported anti-virus software installed.
Page 14 of 17
This software must be active, be scheduled to perform virus checks at regular intervals, and have its
virus definition files kept up to date. If an employee receives what he believes to be a virus, or suspects
that a computer is infected with a virus, it must be reported to the IT Helpdesk immediately.
No employee should attempt to destroy or remove a virus, or any evidence of that virus, without
direction from the IT Department.
• Check with IT Help Desk if you have detected a virus or need assistance with virus
protection measures.
• Scan your hard disk regularly using virus-detecting software. Your system can be
configured to do this automatically.
• Check all incoming disks including commercial software and formatted blank disks,
before using them.
• Use only software from a reliable source.
• Check all email attachment messages with anti-virus software before opening.
• Check with IT Help Desk before downloading Internet Software
8. INTERNET POLICY
Internet is intended to facilitate employee’s in their Balsharaf business endeavors. The following shall
apply:
• Access to internet is granted based on the “nature of work” that user is suppose to do backed
by department head’s approval
• There are 2 type of internet access in Balsharaf environment:
o Restricted Internet Access – for people who need access to certain sites like banks,
government, airlines etc.
o Unrestricted – full access without any boundaries, meant for senior managers or users
who need to use internet in a manner where it cannot come under “Restricted Access”
• All user’s internet usage is recorded in detail as per Balsharaf IT Security policies and there are
per user reports on “total time spent on internet” and “site visited”
• COMPANY reserves the right to remove internet access to users who abuse the internet.
• No Sensitive or Elicit information may be downloaded from or viewed through the internet
browser
• Services shall be implemented to restrict access to websites and services that are considered
undesirable for business use.
• The downloading of large volumes of data and streaming shall be restricted.
Page 15 of 17
Unless you can prove that the following are used for business purposes, do not:
9. BREACH
Where non-compliance is found, the necessary steps will be taken to remedy the situation. The remedy
may include actions as per the Company’s Disciplinary Code.
10. EXEMPTION
The CIO has the sole right to exempt a person or “system” from this policy, or part thereof including
standards and procedures required to fulfill the requirements of this policy.
11. APPENDIX
Ice- Corporate
Agencies cream Finance
Business Retail & (Mawtin (Baity, Real
(Omar Ali Wholesale Baraka, Estate,
Balsharaf (Balsharaf Transport Nassim Export Investment,
IT Services Trading) Markets) Business Atyibat) Business Industrial) Service Owner Title
SAP FICO Yes Yes Yes Yes ERP Support Manager
SAP HCM Yes Yes Yes Yes Yes Yes ERP Support Manager
SAP SD & MM Yes Yes Yes ERP Support Manager
SAP WMS Yes ERP Support Manager
SAP IS Retail Yes ERP Support Manager
HHT (Van Sales Automation) Yes Yes Manager HHT
HHT (Inventory & Receiving) Yes IT Manager
Active Directory Yes Yes Yes Yes Yes Yes Systems Manager
Page 16 of 17
Exchange Yes Yes Yes Yes Yes Systems Manager
Email (External Hosting) Yes Systems Manager
Anti Virus Yes Yes Yes Yes Yes Yes Systems Manager
IP Telephone Yes Yes Yes Yes Yes Manager Networks
RightFax Yes Yes Yes Yes Yes Manager Networks
Billing Yes Yes Yes Yes Manager Networks
POS (ACP) Yes IT Manager
ERP (ALPHA) Yes ERP Support Manager
ERP (AL BASEET) Yes ERP Support Manager
IT Help Desk (User support) Yes Yes Yes Yes Yes Yes Sr Helpdesk supervisor
Help desk for Maintenance &
Workshop Yes IT Manager
Vehicle maintenance and
Asset Management Yes IT Manager
HR Portal Yes Yes Yes Yes Yes Systems Manager
Connectivity, Networks &
Security Yes Yes Yes Yes Yes Yes Manager Networks
CCTV Yes Yes Yes Yes Yes Yes Manager Networks
Time & Attendance Yes Yes Yes Yes Yes Yes Systems Manager
Access Control Yes Yes Yes Yes Yes Yes Systems Manager
Internet Yes Yes Yes Yes Yes Yes Manager Networks
PMO - IT Projects &
implementations Yes Yes Yes Yes Yes Yes IT Manager
MIS & Reports development Yes Yes Yes Yes Yes Yes IT Manager
Data security & Business
critical IT services Continuity Yes Yes Yes Yes Yes Yes IT Manager
Procurement and distribution
of IT Assets, consumables,
stationary Yes Yes Yes Yes Yes Yes IT Manager
IT Asset management Yes Yes Yes Yes Yes Yes IT Manager
Websites and hosting Yes Yes Yes Yes Yes Yes Systems Manager
File Server Yes Yes Yes Yes Yes Yes Systems Manager
Page 17 of 17