DataClassificationPolicy

Roles and Responsibilities within the Entity All entities shall designate persons to be responsible for performing the obligations assigned to each of the job roles associated with the data classification process and the conditions for its protection as outlined below: Public Business Data Executive: A person responsible for the data being collected and maintained by the entity, usually a member of senior management. The Business Data Executive shall address the following: •! Data classification: Classify all data collected by the entity or its affiliates; •! Data compilation: Ensure that data compiled from multiple sources is classified at the highest level of individual classification; •! Data classification coordination: Ensure that data shared between departments or entities is consistently classified and protected. •! Data classification compliance (in coordination with Business Data Stewards): Ensure that data is protected as per specific controls. Data Classification Reviewer: Usually a member of senior management, a Data Classification Reviewer is responsible for reviewing and approving the data classification levels as defined by the Business Data Executive, Business Data Steward: A Business Data Steward is usually a member of the IT and/or Information Security departments. He is responsible for protecting the data by applying the approved controls as per the provisions of the section entitled “Data Classification Controls.” He also maintains and supports the systems, databases, and servers that store data. The duties of a Business Data Steward can be outlined as follows: •! Access control: Ensure that proper access controls are implemented, monitored and reviewed in accordance with the Data Classification levels designated by the Business Data Executive. •! Audit reports: Submit an annual report to Data Administrators addressing availability, integrity and confidentiality of classified data. •! Data backups: Perform regular backups of data. Public •! Data validation: Validate data integrity on a periodical basis. •! Data restoration: Restore data from backup media. •! Monitoring activity: Monitor and record data activities, including information on any person accessing such data. •! Data Classification compliance (in coordination with Data Administrators): Ensure that the entity’s data is classified and secured following the process described in these Policies and in accordance with the defined controls. Data User: An employee who manages, accesses, uses, or updates data to complete a task authorized by the Business Data Executive. A Data user shall benefit from the data in line with the set purposes and in compliance with these Policies and all policies related to data usage across the Kingdom. The head of the entity shall assign the above roles to qualified people within the entity as he deems appropriate. Public