Information Security Policy

Article-level navigation isn't available for this document — showing the full text as extracted.

Information Security Unit
Information Security Policy
MBZUAI-ISU-IS-POL-V1.0
Effective Date 30/09/2023

Page 2 of 6
Table of Contents
1. Document Control Information ............................................................................................................ 3
2. Glossary of Terms.................................................................................................................................. 3
3. Introduction .......................................................................................................................................... 4
4. Objective ............................................................................................................................................... 4
5. Scope ..................................................................................................................................................... 4
6. Information Security ............................................................................................................................. 4
6.1 Information Security Policy ........................................................................................................... 4
6.2 Information Security Objectives ................................................................................................... 5
6.3 Implementation ............................................................................................................................ 5
6.4 Management review ..................................................................................................................... 6
6.5 Key Performance Indicator (KPI) ................................................................................................... 6
7. Related Documents ............................................................................................................................... 6
8. Version History ...................................................................................................................................... 6

Page 3 of 6
Department Information Security Unit Approval Date 30/09/2023
Policy Number MBZUAI-ISU-IS-POL-V1.0 Revision Date 30/09/2024
Policy Information Security Policy Policy Owner IS Manager
1. Document Control Information
Document Name Information Security Policy
Reference Number MBZUAI-ISU-IS-POL-V1.0
Department Name Information Security Unit
Owner/ Updated – Developed by Information Security Manager
Version Number 01
Approval Date 30/09/2023
Approved By President
Date of Last Review N/A
Date for Next Review Annual
For Office Use – Keywords for search function
Policy Review
Person responsible Workflow Date
Information Security Manager Initiator 04 Sep 2023
Information Security Governance Committee Reviewer 06 Sep 2023
VP Corporate Services Endorse 06 Sep 2023
Head of IEQA Reviewer 05 Sep 2023
Executive Director IEQA & Strategy Endorse 20 Sep 2023
General Counsel/Legal Endorse 06 Sep 2023
President Approver 30 Sep 2022
2. Glossary of Terms
Term Definition
Confidentiality The need to ensure that information is disclosed only to those who are
authorized to view it
Integrity The need to ensure that information has not been changed accidentally
or deliberately, and that it is accurate and complete.
Availability The need to ensure that the business purpose of the system can be met
and that it is accessible to those who need to use it.

Page 4 of 6
Department Information Security Unit Approval Date 30/09/2023
Policy Number MBZUAI-ISU-IS-POL-V1.0 Revision Date 30/09/2024
Policy Information Security Policy Policy Owner IS Manager
3. Introduction
Mohammad Bin Zayed University Of Artificial Intelligence (MBZUAI), through its Risk Management Framework,
is committed to maintaining its Information Security and establishing an appropriate level to protection,
maintain and control confidentiality, integrity and availability, and access to its business and classified
information, systems and supporting assets.
This policy forms the basis and identifies key principles of all Information Security initiatives in MBZUAI.
4. Objective
The objective of this policy is to is to demonstrate and express the intention and commitment of Mohammad
Bin Zayed University of Artificial Intelligence [MBZUAI’s] to:
• Protect information assets from all threats, whether internal or external, deliberate or accidental thereby
ensuring uninterrupted services to Staff, Faculties, Researchers, Students and Vendors
• Manage the risk to the acceptable level through design, implementation and maintenance of an effective
Information Security Management system
5. Scope
This Information Security Policy applies to all MBZUAI staff, faculty, contractors and third-party organizations
involved in managing information security at MBZUAI.
6. Information Security
6.1 Information Security Policy
6.1.1 MBZUAI top management is committed to an effective Information Security Management System
that assures normal business operations to support MBZUAI’s mission and strategic objectives.
MBZUAI Information Security Management System adopts the risk-based approach in-line with
MBZUAI’s risk management process.
6.1.2 MBZUAI is committed to maintain:
• Confidentiality: ensuring that information and information systems are accessible only to those
who are authorized to have access.
• Integrity: safeguarding the accuracy and completeness of information, information systems and
processing methods.
• Availability: ensuring authorized users have access to information, information systems and
associated assets when required.
6.1.3 MBZUAI management is committed to complying with all applicable UAE legislations.
MBZUAI is committed to the establishment and continual improvement of all necessary policies, procedures,
and processes to meet the requirements of the UAE Information Assurance Regulation.

Page 5 of 6
Department Information Security Unit Approval Date 30/09/2023
Policy Number MBZUAI-ISU-IS-POL-V1.0 Revision Date 30/09/2024
Policy Information Security Policy Policy Owner IS Manager
6.2 Information Security Objectives
The following are the ISMS objectives set to ensure protection of confidentiality, integrity, and availability of
all business, services, and information.
6.2.1 Establishing a secure culture in the organization by spreading ISMS awareness.
6.2.2 To identify, through appropriate risk assessment, the value of information assets to understand
their vulnerabilities and the threats that may expose them to risk.
6.2.3 To decrease information security incidents.
6.2.4 To manage the risks to an acceptable level through the design, implementation, and maintenance
of a formal information security management system.
6.2.5 To establish internal SLAs for Incident Response.
6.2.6 To ensure the availability of critical services by successfully testing the restoration of backups.
6.2.7 To improve IT service management and IT asset management through the implementation of a
service desk system.
6.2.8 To enhance the Information security office functions by introducing security monitoring, threat
intelligence and hunting, security incident handling and analysis, vulnerability management, etc.
6.2.9 Compliance with applicable legal and regulatory requirements.
6.2.10 The objectives of the ISMS will be evaluated and monitored as part of management reviews to
ensure that they remain valid. The achievement of objectives will be tracked regularly.
6.2.11 A regular review cycle will also be used for setting new objectives for ISMS to coincide with the
budget planning cycle. This will ensure that adequate funding is obtained for the improvement
activities identified.
6.3 Implementation
6.3.1 MBZUAI’s management acknowledges the importance of ensuring information security and is
committed to supporting the information security goals and principles. MBZUAI top management has
given below principles for the effective implementation of ISMS in the organization:
• Establish the ISGC Committee representing the executive management of the MBZUAI to
demonstrate MBZUAI’s management commitment towards information security management.
• Appoint the ‘Head of the Information Security Unit as the Information Security Manager
responsible for managing all information security-related activities of MBZUAI.
• Appoint Governance, Risk and Compliance (GRC) team for representing MBZUAI for coordinating
and managing information security activities as per the requirements of UAE Information
Assurance Regulation.
• Define the roles and responsibilities of all ISGC Committee.
• Prepare ISMS scope, policies, objectives, and guidelines to support the implementation of the
ISMS Policy.
• Develop an ISMS framework to assess information security risks.
• Develop a risk assessment report and risk treatment plan.
• Obtain management approval for implementing controls for risk mitigation and formal
acceptance of residual risk.
• Allocate appropriate resources for the implementation, management, and operation of ISMS.
• Define and conduct training and awareness programs for all MBZUAI Staff.

Page 6 of 6
Department Information Security Unit Approval Date 30/09/2023
Policy Number MBZUAI-ISU-IS-POL-V1.0 Revision Date 30/09/2024
Policy Information Security Policy Policy Owner IS Manager
• Establish the process in the organization for continual improvement of ISMS.
6.4 Management review
6.4.1. The top management of MBZUAI will review, communicate, and make available this document to all
MBZUAI ISMS affected parties and other interested parties to ensure compliance with this policy.
6.4.2. The top management will review the management objectives and approve the ISMS at planned
intervals or at least once annually.
6.4.3. The top management shall determine corrective actions as an output of the management review
meeting.
6.4.4. The policies, procedures, and all documents of ISMS will be reviewed on an annual basis.
6.4.5. Internal audits will be done at least once a year.
6.5 Key Performance Indicator (KPI)
6.5.1 Information Security Policy should be at least communicated once a year to all MBZUAI end users.
7. Related Documents
Section Related Document(s)
UAE Information Assurance Regulation v1.1
8. Version History
Version number Person responsible Date of change Comments
V0.1 Information Security Manager 04/09/2023 First Draft
V0.1 Information Security Manager 06/09/2023 First Draft approved by Information
Security Governance Committee
including members in the policy
review workflow: VP corporate
service, General Counsel/Legal.
V.01 Information Security Manager 20/09/2023 Minor changes on Typos by
A/Executive Dir. IEQA & Strategy