(Get Answer)

writing project and need a sample draft to help me learn. Hello , i have 26 Existing documents and i need to copy them into new template. i uploded 1 example with the desire template to be copied and paste. i will be uploading the rest once you got the idea. font for the headlines is (Gotham Rounded Med) Size (12). for the text (Gotham Rounded Light) Size (10). Regards, Requirements: copy to new template Cybersecurity Policies 2/9/2023 Version 1.0 Policies Version 1.0 Cybersecurity Policies 2/9/2023 Version 1.0 Version Control Reviewers Approvals Author: refers to the individual who carried out the initial tasks of preparing and revising the document Reviewer: refers to the individual(s) who took part in assessing, providing comments, and endorsing the changes to the document Approver: refers to the individual(s) with the authority to approve the document so that it can be issued and implemented Note This document is to be reviewed and updated within a period that does not exceed 12 Months of its effective release date and to is amended whenever there is a change in the approval policy Chapter 1 – About this Policy Purpose of this Policy The purpose of the policy is to outline the acceptable use of IT assets at SIRC. These rules are in place to protect the employees and the organization. Inappropriate use exposes SIRC to risks including virus attacks, compromise of network systems and services, and legal issues. The objective of defining acceptable use requirements is to establish acceptable use of SIRC’s resources in conjunction with its established culture of ethical and lawful behavior, openness, trust and integrity. Scope of this Policy This policy and supporting processes encompass all resources and supporting assets owned, operated, maintained, and controlled by SIRC, and all other resources, internally and externally, interacting with SIRC SIRC’s employees and contractors who are responsible for processing and consuming SIRC’s data (structured and unstructured), including storing, transferring, and managing data All geographical locations and jurisdictions where the SIRC’s businesses operate All SIRC’s systems, services, and processes that handle data Related regulations, policies, and processes ISO 27001:2013 Standards NIST 800-53 Framework Review and approval All enquiries and requests for revisions relating to any of the matters specified in this Manual shall be addressed to the controller. The controller of the manual should ensure that: The contents of this manual are confidential and are meant only for internal use by SIRC All the revisions made to the Manual are based on proper approvals as per Delegation of Authority Any circulation of this Manual in whole or in part is based on proper approvals Requests for revising the manual (add / delete / amend) can be originated by any of the users of the manual. Requests for revision shall be addressed to the controller of this Manual and submitted for approval as per Delegation of Authority. Once approved, the custodian will update the Manual with the approved revisions. If the revision is not approved, notification to that effect will be sent to the originator by the Custodian. After the changes are incorporated in the Manual, the Custodian should update the version and date of the Manual. Any copy of the Manual, if printed out, shall have an “un-maintained” status and no guarantee can be given that the policies stipulated in a printed Manual are in fact the policies that are required to be followed. Users of this Manual are therefore encouraged not to print out hard copies of the Manual and refer to only to the electronic version Main Roles & Responsibilities Cybersecurity Team Cybersecurity team is responsible for annually reviewing, updating, and communicating the information security policy in case of any environmental changes. Identify exception to policy and review periodically. Cybersecurity team is responsible for verifying compliance with policy and assessing the effectiveness of the control deployed to achieve compliance User Need to adhere to Acceptable use Policy Compliance to Policy Adherence to the provisions and requirements of this document is mandatory for all SIRC employees. Policy owner is held responsible for full compliance with policy. Any deviation or noncompliance with policy lies under full accountability of department head and should be reported to the GRC as an operational risk and to internal audit unit to undertake the necessary control measures In case of any breach of this policy, the Human Resources Division must be notified The terms of this policy shall not be violated Access to the document Access to this Manual will be restricted to “read only” for all users to prevent unauthorized modification To ensure that the Manual referred to by any reader is the current version, the Manual shall be maintained in a central electronic repository on SIRC’s network It is very important that this policy remains the property of SIRC(SIRC) and no one other than SIRC employees is allowed to use this guide This policy has been developed to comply with Saudi Entertainment Ventures' organizational structure and practical requirements. Best practices have been integrated into policies to ensure adequate internal controls and the efficiency of the public sphere. Exception There will be no waiver on acceptable usage of data or information, however in-case of business requirement, exception shall be granted based on the approval of Business Team, and it must have valid timeframe of it. All exceptions must be review on periodic basis to validate risks associated with exception. List of Abbreviations and Definitions Definitions Chapter 2 – Policies Acceptable Use Standards The following activities are strictly prohibited, with no exception and applicable to SIRC employees, subsidiaries, vendors, and contractors: Violating the rights of any SIRC employee or vendor, protected by copyright, trade secret, patent or other intellectual property, or similar laws or regulations, including, but not limited to, the installation or distribution of "pirated" or other software products that are not appropriately licensed for use by SIRC. Exporting software, technical information, encryption software or technology, in violation of international or regional export control laws. Attempts to discover the system details (like ports, services, accounts, etc.) and/or access data on any SIRC's system in an unauthorized manner. Such attempts may include, but are not limited to port/system scan, sniffing, circumventing authentication systems, hacking and any other similar activity, that may lead to security breaches and service disruption. Sharing confidential and regulated data of SIRC to unauthorized/unintended recipients which may lead to competitive disadvantage, reputational damage, and loss of a customer to SIRC. Such data include, but are not limited to reports that detail SIRC’s revenue or weakness of SIRC's systems, financial reports, client/customer details, SIRC employee’s PII (Personal Identifiable Information), etc. Acceptable use Assets SIRC employees shall use SIRC-provided laptops and IT assets only to meet the official tasks and business requirements of SIRC. The activities of the users must not damage the integrity of SIRC assets or SIRC data. All systems storing and processing SIRC's internal, confidential, and regulated data should have the capability of locking the screen. Users of those systems must lock the screens prior to moving away from the systems. Whether at the company premise or in public places, users using SIRC's systems Must use laptop cable lock system to protect it from thefts Must exercise due care while using desktops/ laptops and protect it from physical damage, food, and liquids spill Approved shared folders, network drives or online locations must be used to backup and/or store SIRC’s data. Wherever applicable, strong, and complex passwords must be applied as per SIRC’s Password Management policy. Authentication data like credentials, tokens, cookies, used to protect/restrict access to SIRC's data, etc. must not be stored anywhere by the user. Users should ensure that the authentication information (passwords, tokens) is kept confidential and is not divulged to any other parties, including people of authority in any manner. Users shall be responsible and accountable for security of IT assets owned or accessed by them. In case of loss or theft of SIRC’s asset, users shall be responsible to promptly report the theft to Cybersecurity team. Acceptable use of Software Users shall only use software which is approved. Download and installation of freeware, spyware and pirated software on SIRC's assets is prohibited considering potential threats to SIRC resources. Freeware software, if necessary, can only be used if there is a genuine business justification and approval from Cybersecurity or IT team. Record of all freeware software installed on SIRC's assets and approved by the Cybersecurity or IT team shall be maintained and monitored. Users shall not download and install games, movies, utilities, screen savers, wallpapers, or other personal software on SIRC's assets unless it is related to business and the approval has been obtained from respective business heads and Cybersecurity and IT team. Acceptable use of E-mail Service Email systems, internet and instant messaging systems provided by SIRC shall only be used for official / business purposes. Use of third-party email services for SIRC's business are prohibited. These systems may be used for limited and reasonable personal use with due consideration to the following: Protection of SIRC intellectual property and sensitive information Avoid conflict of interest User’s productivity Users shall not indulge in unlawful activities leveraging SIRC's email and internet services which may cause harm to SIRC’s reputation or business delivery capability. This includes, but is not limited to, the below: Unauthorized using or forging of email header information. Sending advertising material to individuals who did not specifically request such material (email spam) Distribution of any disruptive or offensive messages, including offensive comments about race, gender, hair color, disabilities, age, sexual orientation, pornography, religious beliefs and practice, political beliefs, or national origin. Users will be held responsible for: Copying or sharing SIRC's related sensitive information through E-mail which could cause confidentiality breach Clicking on malicious and phishing emails which could lead to compromise of SIRC's system, data, or downtime of systems Legal implications for not following requirements like use of digital signature and encryption Although SIRC encourages use of IT resources for carrying out business transactions with due respect to privacy of employees, at any time and without prior notice SIRC reserves the right to examine information stored or transmitted on SIRC computers or networks, including but not limited to, personal files, directories, emails, instant messaging, etc. for the following purposes: Preventing unauthorized access and system misuse Retrieving business related information during contingencies Security incident investigation Compliance with legal and regulatory requirements Users shall only use authorized instant messaging software and shall not use public instant messaging services for confidential business communication. Users shall provide all information related to email and internet usage whenever required or asked by authorized personnel. Prior to sharing SIRC information, users shall consider classifying information and applying appropriate protection methods based on the classification in line with the Information Classification Policy. Users must be vigilant to identify and report: Phishing emails to csops@sirc.sa Unsolicited, offensive, or harassing emails to Legal Department / HR Department Acceptable use of Internet Services SIRC provides internet services to be solely used to perform SIRC’s business operations. Users must consider their Internet activities as periodically monitored and limit their activities accordingly. Users who choose to store or transmit personal information such as private keys, credit card numbers or certificates or make use of Internet "wallets" do so at their own risk. SIRC is not responsible for any loss of information, such as information stored in the wallet, or any consequential loss of personal property. Users will be responsible for accessing websites that would constitute or encourage a criminal offense, lead to civil liability, or otherwise violate any regulations, local, state, national or international law. Reproduction of materials available over the Internet must be done only with the written permission of the author or owner of the document. Unless permission from the copyright owner(s) is first obtained, making copies of material from magazines, journals, newsletters, other publications, and online documents is forbidden unless this is both reasonable and customary. Acceptable use of social media Users shall not post/ communicate/ express their views on behalf of SIRC via social media unless they are authorized to do so, and they shall not disclose/ post any information which could harm the reputation of SIRC. Users shall not create personal social media account using SIRC’s email address or credentials that are used to authenticate SIRC assets. Users shall always respect the dignity of colleagues and competitors while posting any information on social media. Employees must not engage in any blogging that may harm or tarnish the image, reputation and/or goodwill of SIRC and/or any of its employees. Apart from following all laws pertaining to the handling and disclosure of copyrighted or export-controlled materials, SIRC’s trademarks, logos, and any other SIRC’s intellectual property may also not be used in connection with any blogging activity. Acceptable use of Removable Media Users shall not be allowed to use removable media unless there are legitimate business needs and approval. Usage of removable media must be approved by the Cybersecurity Department. All removable media must be encrypted and scanned for malware before connecting to SIRC systems. Users shall be held accountable for: Copying or sharing SIRC related sensitive information through removable media, which could cause confidentiality breach. Causing transmission of malicious code from removable media to SIRC networks. Execution of unauthorized software programs from removable media, which could potentially lead to security incidents. All SIRC provided removable media shall be subject to quarantine upon return by employee, before being reused and utilized. Users shall permanently erase SIRC specific and business confidential data from such devices once they are no longer required. Acceptable use of Mobile Device Users requiring SIRC related information access on handheld devices shall follow registration and approval procedures in-line with BYOD and Mobile Device security requirements. Only authorized users shall be allowed to take photographs and shoot video clips within SIRC office premises. Acceptable Use of Password Usage Users are accountable for all activities associated with their user IDs and passwords (credentials). Users should never use their SIRC’s credentials with non- SIRC applications and/or websites Users must change their passwords upon initial log in and/or when required (e.g. expiration or a password reset by the Help Desk) Users must change their passwords if they suspect a compromise. Passphrases and multi-factor authentication are strongly recommended. Users must keep their passwords secure and confidential. Sharing credentials is prohibited. Users are prohibited from attempting to circumvent authentication and/or security of any computer, host, network, or application account. Acceptable Use of Printing Print only what you absolutely need. If more than one copy of any print is needed, photocopy the original. Lengthy documents tie up the printer and should be downloaded or e-mailed whenever possible. Any large printing that must be printed should be done so during non-peak or off hours when printer usage is at a minimum. Printers are only used to print SIRC related documents. Individual shall not print personal documents via printer. Retrieve printed document once printing process has been completed. If any document found in printer tray, please inform security supervisor. Acceptable Use of Virtual Meetings Use SIRC approved software of conducting virtual meetings Record the meeting session after taking consent approval of meeting participants. The recorded session is available for 3-6 months of period. Cybersecurity Policies 2/9/2023 Version 1.0 Policies Version 1.0 Cybersecurity Policies 2/9/2023 Version 1.0 Version Control Reviewers Approvals Author: refers to the individual who carried out the initial tasks of preparing and revising the document Reviewer: refers to the individual(s) who took part in assessing, providing comments, and endorsing the changes to the document Approver: refers to the individual(s) with the authority to approve the document so that it can be issued and implemented Note This document is to be reviewed and updated within a period that does not exceed 12 Months of its effective release date and to is amended whenever there is a change in the approval policy Chapter 1 – About this Policy Purpose of this Policy The purpose of the policy is to outline the acceptable use of IT assets at SIRC. These rules are in place to protect the employees and the organization. Inappropriate use exposes SIRC to risks including virus attacks, compromise of network systems and services, and legal issues. The objective of defining acceptable use requirements is to establish acceptable use of SIRC’s resources in conjunction with its established culture of ethical and lawful behavior, openness, trust and integrity. Scope of this Policy This policy and supporting processes encompass all resources and supporting assets owned, operated, maintained, and controlled by SIRC, and all other resources, internally and externally, interacting with SIRC SIRC’s employees and contractors who are responsible for processing and consuming SIRC’s data (structured and unstructured), including storing, transferring, and managing data All geographical locations and jurisdictions where the SIRC’s businesses operate All SIRC’s systems, services, and processes that handle data Related regulations, policies, and processes ISO 27001:2013 Standards NIST 800-53 Framework Review and approval All enquiries and requests for revisions relating to any of the matters specified in this Manual shall be addressed to the controller. The controller of the manual should ensure that: The contents of this manual are confidential and are meant only for internal use by SIRC All the revisions made to the Manual are based on proper approvals as per Delegation of Authority Any circulation of this Manual in whole or in part is based on proper approvals Requests for revising the manual (add / delete / amend) can be originated by any of the users of the manual. Requests for revision shall be addressed to the controller of this Manual and submitted for approval as per Delegation of Authority. Once approved, the custodian will update the Manual with the approved revisions. If the revision is not approved, notification to that effect will be sent to the originator by the Custodian. After the changes are incorporated in the Manual, the Custodian should update the version and date of the Manual. Any copy of the Manual, if printed out, shall have an “un-maintained” status and no guarantee can be given that the policies stipulated in a printed Manual are in fact the policies that are required to be followed. Users of this Manual are therefore encouraged not to print out hard copies of the Manual and refer to only to the electronic version Main Roles & Responsibilities Cybersecurity Team Cybersecurity team is responsible for annually reviewing, updating, and communicating the information security policy in case of any environmental changes. Identify exception to policy and review periodically. Cybersecurity team is responsible for verifying compliance with policy and assessing the effectiveness of the control deployed to achieve compliance User Need to adhere to Acceptable use Policy Compliance to Policy Adherence to the provisions and requirements of this document is mandatory for all SIRC employees. Policy owner is held responsible for full compliance with policy. Any deviation or noncompliance with policy lies under full accountability of department head and should be reported to the GRC as an operational risk and to internal audit unit to undertake the necessary control measures In case of any breach of this policy, the Human Resources Division must be notified The terms of this policy shall not be violated Access to the document Access to this Manual will be restricted to “read only” for all users to prevent unauthorized modification To ensure that the Manual referred to by any reader is the current version, the Manual shall be maintained in a central electronic repository on SIRC’s network It is very important that this policy remains the property of SIRC(SIRC) and no one other than SIRC employees is allowed to use this guide This policy has been developed to comply with Saudi Entertainment Ventures' organizational structure and practical requirements. Best practices have been integrated into policies to ensure adequate internal controls and the efficiency of the public sphere. Exception There will be no waiver on acceptable usage of data or information, however in-case of business requirement, exception shall be granted based on the approval of Business Team, and it must have valid timeframe of it. All exceptions must be review on periodic basis to validate risks associated with exception. List of Abbreviations and Definitions Definitions Chapter 2 – Policies Acceptable Use Standards The following activities are strictly prohibited, with no exception and applicable to SIRC employees, subsidiaries, vendors, and contractors: Violating the rights of any SIRC employee or vendor, protected by copyright, trade secret, patent or other intellectual property, or similar laws or regulations, including, but not limited to, the installation or distribution of "pirated" or other software products that are not appropriately licensed for use by SIRC. Exporting software, technical information, encryption software or technology, in violation of international or regional export control laws. Attempts to discover the system details (like ports, services, accounts, etc.) and/or access data on any SIRC's system in an unauthorized manner. Such attempts may include, but are not limited to port/system scan, sniffing, circumventing authentication systems, hacking and any other similar activity, that may lead to security breaches and service disruption. Sharing confidential and regulated data of SIRC to unauthorized/unintended recipients which may lead to competitive disadvantage, reputational damage, and loss of a customer to SIRC. Such data include, but are not limited to reports that detail SIRC’s revenue or weakness of SIRC's systems, financial reports, client/customer details, SIRC employee’s PII (Personal Identifiable Information), etc. Acceptable use Assets SIRC employees shall use SIRC-provided laptops and IT assets only to meet the official tasks and business requirements of SIRC. The activities of the users must not damage the integrity of SIRC assets or SIRC data. All systems storing and processing SIRC's internal, confidential, and regulated data should have the capability of locking the screen. Users of those systems must lock the screens prior to moving away from the systems. Whether at the company premise or in public places, users using SIRC's systems Must use laptop cable lock system to protect it from thefts Must exercise due care while using desktops/ laptops and protect it from physical damage, food, and liquids spill Approved shared folders, network drives or online locations must be used to backup and/or store SIRC’s data. Wherever applicable, strong, and complex passwords must be applied as per SIRC’s Password Management policy. Authentication data like credentials, tokens, cookies, used to protect/restrict access to SIRC's data, etc. must not be stored anywhere by the user. Users should ensure that the authentication information (passwords, tokens) is kept confidential and is not divulged to any other parties, including people of authority in any manner. Users shall be responsible and accountable for security of IT assets owned or accessed by them. In case of loss or theft of SIRC’s asset, users shall be responsible to promptly report the theft to Cybersecurity team. Acceptable use of Software Users shall only use software which is approved. Download and installation of freeware, spyware and pirated software on SIRC's assets is prohibited considering potential threats to SIRC resources. Freeware software, if necessary, can only be used if there is a genuine business justification and approval from Cybersecurity or IT team. Record of all freeware software installed on SIRC's assets and approved by the Cybersecurity or IT team shall be maintained and monitored. Users shall not download and install games, movies, utilities, screen savers, wallpapers, or other personal software on SIRC's assets unless it is related to business and the approval has been obtained from respective business heads and Cybersecurity and IT team. Acceptable use of E-mail Service Email systems, internet and instant messaging systems provided by SIRC shall only be used for official / business purposes. Use of third-party email services for SIRC's business are prohibited. These systems may be used for limited and reasonable personal use with due consideration to the following: Protection of SIRC intellectual property and sensitive information Avoid conflict of interest User’s productivity Users shall not indulge in unlawful activities leveraging SIRC's email and internet services which may cause harm to SIRC’s reputation or business delivery capability. This includes, but is not limited to, the below: Unauthorized using or forging of email header information. Sending advertising material to individuals who did not specifically request such material (email spam) Distribution of any disruptive or offensive messages, including offensive comments about race, gender, hair color, disabilities, age, sexual orientation, pornography, religious beliefs and practice, political beliefs, or national origin. Users will be held responsible for: Copying or sharing SIRC's related sensitive information through E-mail which could cause confidentiality breach Clicking on malicious and phishing emails which could lead to compromise of SIRC's system, data, or downtime of systems Legal implications for not following requirements like use of digital signature and encryption Although SIRC encourages use of IT resources for carrying out business transactions with due respect to privacy of employees, at any time and without prior notice SIRC reserves the right to examine information stored or transmitted on SIRC computers or networks, including but not limited to, personal files, directories, emails, instant messaging, etc. for the following purposes: Preventing unauthorized access and system misuse Retrieving business related information during contingencies Security incident investigation Compliance with legal and regulatory requirements Users shall only use authorized instant messaging software and shall not use public instant messaging services for confidential business communication. Users shall provide all information related to email and internet usage whenever required or asked by authorized personnel. Prior to sharing SIRC information, users shall consider classifying information and applying appropriate protection methods based on the classification in line with the Information Classification Policy. Users must be vigilant to identify and report: Phishing emails to csops@sirc.sa Unsolicited, offensive, or harassing emails to Legal Department / HR Department Acceptable use of Internet Services SIRC provides internet services to be solely used to perform SIRC’s business operations. Users must consider their Internet activities as periodically monitored and limit their activities accordingly. Users who choose to store or transmit personal information such as private keys, credit card numbers or certificates or make use of Internet "wallets" do so at their own risk. SIRC is not responsible for any loss of information, such as information stored in the wallet, or any consequential loss of personal property. Users will be responsible for accessing websites that would constitute or encourage a criminal offense, lead to civil liability, or otherwise violate any regulations, local, state, national or international law. Reproduction of materials available over the Internet must be done only with the written permission of the author or owner of the document. Unless permission from the copyright owner(s) is first obtained, making copies of material from magazines, journals, newsletters, other publications, and online documents is forbidden unless this is both reasonable and customary. Acceptable use of social media Users shall not post/ communicate/ express their views on behalf of SIRC via social media unless they are authorized to do so, and they shall not disclose/ post any information which could harm the reputation of SIRC. Users shall not create personal social media account using SIRC’s email address or credentials that are used to authenticate SIRC assets. Users shall always respect the dignity of colleagues and competitors while posting any information on social media. Employees must not engage in any blogging that may harm or tarnish the image, reputation and/or goodwill of SIRC and/or any of its employees. Apart from following all laws pertaining to the handling and disclosure of copyrighted or export-controlled materials, SIRC’s trademarks, logos, and any other SIRC’s intellectual property may also not be used in connection with any blogging activity. Acceptable use of Removable Media Users shall not be allowed to use removable media unless there are legitimate business needs and approval. Usage of removable media must be approved by the Cybersecurity Department. All removable media must be encrypted and scanned for malware before connecting to SIRC systems. Users shall be held accountable for: Copying or sharing SIRC related sensitive information through removable media, which could cause confidentiality breach. Causing transmission of malicious code from removable media to SIRC networks. Execution of unauthorized software programs from removable media, which could potentially lead to security incidents. All SIRC provided removable media shall be subject to quarantine upon return by employee, before being reused and utilized. Users shall permanently erase SIRC specific and business confidential data from such devices once they are no longer required. Acceptable use of Mobile Device Users requiring SIRC related information access on handheld devices shall follow registration and approval procedures in-line with BYOD and Mobile Device security requirements. Only authorized users shall be allowed to take photographs and shoot video clips within SIRC office premises. Acceptable Use of Password Usage Users are accountable for all activities associated with their user IDs and passwords (credentials). Users should never use their SIRC’s credentials with non- SIRC applications and/or websites Users must change their passwords upon initial log in and/or when required (e.g. expiration or a password reset by the Help Desk) Users must change their passwords if they suspect a compromise. Passphrases and multi-factor authentication are strongly recommended. Users must keep their passwords secure and confidential. Sharing credentials is prohibited. Users are prohibited from attempting to circumvent authentication and/or security of any computer, host, network, or application account. Acceptable Use of Printing Print only what you absolutely need. If more than one copy of any print is needed, photocopy the original. Lengthy documents tie up the printer and should be downloaded or e-mailed whenever possible. Any large printing that must be printed should be done so during non-peak or off hours when printer usage is at a minimum. Printers are only used to print SIRC related documents. Individual shall not print personal documents via printer. Retrieve printed document once printing process has been completed. If any document found in printer tray, please inform security supervisor. Acceptable Use of Virtual Meetings Use SIRC approved software of conducting virtual meetings Record the meeting session after taking consent approval of meeting participants. The recorded session is available for 3-6 months of period. جل المجموعة السعودية الاستثمارية لإعادة التدوير (سرك) Saudi Investment Recycling Company (SIRC) Board Executive Committee Charter 15 يونيو 2021م