Objectives
Suratthani Rajabhat University sets forth this Information Security Policy and Practices with the following objectives:
2.1 To establish security standards for the use of the university’s IT and communication systems in compliance with relevant laws and regulations.
2.2 To ensure trust in the security and efficiency of the university’s IT systems and communication operations.
2.3 To disseminate the policy and practices to executives, faculty, staff, and students so that they understand, appreciate, and strictly follow them.
2.4 To create a systematic process for regular audit and risk assessment of information and IT systems at least once per year.
2.5 The President, as the Chief Executive Officer (CEO) of the university, is accountable for any risks, damages, or harms to the university or individuals arising from system failures, negligence, or violation of this policy.
2.6 This policy must be reviewed, audited, and updated at least annually or whenever significant changes occur.
3. Policy Goals
The goals of this policy are:
3.1 To promote and support information security in line with the university’s mission and policies.
3.2 To govern IT operations to ensure systems are accurate, complete, and available.
3.3 To raise awareness and understanding among all stakeholders, both internal and external.
3.4 To monitor, assess, and revise the information security policy and practices in response to changing circumstances.
4. Components of the Policy
This Information Security Policy and Practices is structured to align with the university’s strategic approach to information security, comprising:
Definitions
Part 1: Information Access Control Policy
-
Information access control within the university
-
User access management
-
User responsibilities
-
Network access control
-
Use of the Internet
-
Server management
-
Electronic mail usage and control
-
Operating system access control
-
Server access control
-
Public computer access control
-
Application and information system access control
-
Traffic log management
-
System administrator responsibilities
-
Use of social networks
-
Physical and environmental security
Part 2: Backup and Recovery Policy
Part 3: Verification and Information Risk Assessment Policy
Part 4: Information Security Awareness Policy
Each section includes objectives, standards, guidelines, and procedures that collectively ensure the university’s IT infrastructure remains secure and resilient. Compliance with this policy is mandatory for all staff, system users, and external agencies that interact with the university’s IT systems.
