IT Charter - National School of Cybersecurity (NSCS)

IT Charter

As part of the implementation of the National Information Security Framework (RNSI), the National Higher School of Cybersecurity is committed to establishing a structured information security approach and promoting a cybersecurity culture among all users of its Information Systems.

General Provisions

Preamble, purpose, scope and ownership

This Charter aims to establish a minimum set of rules, good practices, and responsible behaviours designed to preserve the security and integrity of the School's Information Systems.

Articles

1
Purpose: The purpose of this Charter is to define the conditions and procedures governing the use of the School's IT resources. It also sets out the security rules that users are required to comply with.
2
Scope of Application: This Charter applies to any person who has permanent or temporary access to the School's IT resources, including: Teaching and research staff; Administrative staff; Students; Authorized partners.
3
Ownership: All IT resources made available to users are the exclusive property of the School. Data produced, processed, or hosted as part of the School's activities shall be managed in accordance with the applicable laws and regulations, particularly those relating to intellectual property rights.
8
The School's Obligations: The School undertakes to: Provide users with the IT resources necessary for the performance of their duties; Ensure, to the extent of the available resources, the proper functioning and availability of such resources; Inform users of the procedures and policies applicable to IT resources; Implement the necessary measures to ensure the confidentiality and integrity of electronic documents and communications; Inform users that activities carried out on the network and systems may be subject to automated monitoring for security purposes; Raise users' awareness of cybersecurity risks.
18
Entry into Force: This Charter shall enter into force upon its publication on the School's website.

Access & Use of Resources

Authentication, email, internet and mobile devices

The user is solely responsible for any use of the authentication credentials provided to them by the School. Users must comply with the rules governing the use of IT resources.

Articles

4
Access to IT Resources: Access to the School's IT resources and networks is subject to prior authentication. The user is solely responsible for any use of the authentication credentials provided to them by the School. In order to safeguard these credentials, users must: Ensure the protection and confidentiality of their authentication information; Change their passwords periodically; Never disclose their authentication information to third parties.
7
Use of IT Resources: The School's IT resources may only be used for professional, administrative, educational, or research purposes; Users must safeguard the IT resources and facilities made available to them; Users are not authorized to install or deploy applications or softwares on IT equipment without the approval of the IT Department; In the event of a malfunction, users must immediately notify the IT Department.
9
User Obligations: Users must: Comply with all applicable laws and regulations; Comply with this Charter and the School's internal policies; Implement the required security measures and follow security directives; Not use or attempt to use another person's account; Report without delay any security incident or suspicious behaviour.
11
Professional Email: The School provides users with email accounts for strictly professional use. It is prohibited to: Use such accounts for personal purposes; Use them to register for personal accounts on social networks, forums, or unauthorized websites; Open attachments and/or links originating from unknown sources; Access professional email from unsecured public locations. Users must: Verify the accuracy of recipients' email addresses; Ensure that recipients are authorized to receive the information or content concerned; Never use a personal email address to transmit professional documents.
12
Use of the Internet: Users undertake to: Not use the Internet for malicious, obscene, fraudulent, hateful, defamatory, or unlawful purposes; Avoid unnecessary network congestion; Exercise caution when downloading files.
13
Mobile Devices and Storage Media: Users must: Immediately report any loss or theft of a professional mobile device or storage medium; Lock their mobile devices when they are not in use; Disable Wi-Fi and Bluetooth when they are not needed; Scan all removable media before use; Encrypt sensitive data stored on mobile devices and storage media; Keep their devices in their possession at all times during professional travel.

Security & Incident Management

Workstation protection, incidents and non-compliance

Users must strictly comply with security requirements in order to preserve the integrity of the School's Information Systems.

Articles

10
Workstation Security and Protection: Users must strictly comply with the following security requirements: Lock access to their workstation whenever they are away from it, even temporarily; Alert the IT Department upon discovering any unknown or unauthorized equipment; Ensure that their workstation has an active and up-to-date security solution; Never connect personal devices without authorization; Scan all removable media before use; Shut down their workstation during extended periods of inactivity; Not carry out any hardware or software intervention without the prior authorization of the IT Department.
16
Incident Management: In the event of an incident that may affect security, the School may: Disconnect a user, with or without prior notice depending on the severity of the situation; Temporarily isolate or neutralize any data or file that is in breach of this Charter or that may jeopardize the security of the School's Information Systems.
17
Non-Compliance with the Charter: Failure to comply with the rules set out in this Charter may result in the user incurring liability and may lead to disciplinary measures proportionate to the seriousness of the established facts. Subject to informing the user's line manager, the following measures may be taken: Issue a warning to the user concerned; Temporarily restrict or revoke the user's access rights; Delete, compress, or isolate any data or file that is in breach of this Charter or that may jeopardize the security of the School's Information Systems. Without prejudice to disciplinary sanctions, any person who violates the provisions of this Charter may be subject to legal proceedings.

Travel & Termination

Travel abroad and return of resources

Users travelling abroad on official business must comply with specific requirements in order to preserve the security of the School's resources and data.

Articles

14
Security Measures During Travel Abroad: Users travelling abroad on official business must: Avoid using public terminals to access their professional accounts; Keep their professional equipment and storage media with them at all times; Disable Wi-Fi and Bluetooth when they are not needed; Remove any sensitive data that is not essential before departure; Inform their line manager and the Algerian diplomatic mission in the event of an inspection or seizure by a foreign authority; Not use equipment provided or offered to them during the trip for professional purposes; Change their passwords upon their return.
15
Termination: When the relationship between the user and the School comes to an end, the user must return all hardware and IT resources provided to them. The School shall revoke all logical access rights granted to the user to access IT resources made available to them.