1. Introduction
The University of Hail is committed to enhancing its ability to continue its academic, research, administrative, and support services operations in the event of disruptions affecting its activities, resources, or digital services. This policy establishes the institutional framework for business continuity management, encompassing preparedness, response, continuity of priority services, recovery, and return to normal operations, while prioritizing the safety of individuals at all stages of disruption management.
2. Purpose and Objectives
This policy aims to standardize business continuity requirements across the university, define responsibilities, and establish planning and monitoring mechanisms, achieving the following objectives:
1. Protecting the safety of students, faculty, staff, and visitors, in conjunction with approved emergency and safety plans.
2. Maintaining the provision of priority activities and services at an acceptable and predefined level during disruptions.
3. Identifying the impacts of business interruptions, restoration priorities, resource requirements, and inter-agency and inter-service dependencies.
4. Minimizing the academic, operational, financial, organizational, and reputational impacts resulting from disruptions.
5. Enhancing the readiness of response and recovery teams and verifying the effectiveness of plans through training, exercises, and testing. 6. Supporting compliance with relevant regulatory, organizational, and contractual requirements, and continuous improvement based on monitoring results.
3. Scope of Application
This policy applies to all colleges, deanships, departments, centers, units, and branches of the University of Hail. It encompasses academic, research, and administrative activities, digital services, infrastructure, facilities, and resources necessary for their operation. It includes faculty members, staff, and students according to their roles, as well as suppliers, contractors, and service providers within the limits of their contractual obligations.
The scope includes services hosted or provided by external parties when the university's operations depend on them. No activity will be excluded based on its location, duration, or hosting method without assessing its impact and establishing the scope limits. The comprehensiveness of the policy does not imply that all activities must be restored simultaneously; rather, priorities will be determined based on an analysis of the impact of business interruptions.
4. Definitions
• University: The University of Hail.
• Deanship: The Deanship of Information Technology and E-Learning at the University of Hail.
• Competent Authority: The entity officially tasked with managing business continuity at the university level, according to the approved structure and resolutions. • Business Continuity Management: An administrative process for identifying the impacts of disruptions and threats and building the capacity to continue priority activities, respond, and recover.
• Business Continuity Management System: The set of policies, processes, responsibilities, resources, and records used to establish, implement, monitor, and improve continuity.
• Disruption: An event that disrupts or threatens to disrupt the delivery of a service or the execution of an activity at its usual level.
• Priority Activities: Activities that must be restored or continued first to avoid unacceptable impacts on the university and its stakeholders.
• Business Disruption Impact Analysis: A process for identifying the impacts of a disruption over time, continuity requirements, restoration priorities, resources, and dependencies.
• Maximum Tolerable Interruption Duration: The duration after which the impacts of not resuming an activity become unacceptable.
• Recovery Time Target: The target time for resuming an activity, service, or resource at a specified level after a disruption.
• Recovery Point Target: The point in time to which data must be restored, defining the acceptable amount of data loss measured in time.
• Business Continuity Plan: Documented procedures that guide the response to a disruption and the continuation or resumption of activities according to approved requirements. • IT Disaster Recovery: Restoring the systems, data, and technical infrastructure necessary to support business operations, in accordance with approved recovery priorities and objectives.
5. General Principles
1. Prioritize the safety of individuals over operational considerations.
2. Implement a unified approach that aligns with the nature of the activities, their level of risk, and the impact of the disruption.
3. Define continuity requirements based on documented analysis and link them to feasible and testable capabilities and resources.
4. Each entity is responsible for its own business continuity, with institutional coordination and integrated plans across entities.
5. Protect personal information and data during backup operations, response, and recovery.
6. Integrate continuity requirements into planning, projects, changes, procurement, and contracts.
7. Document decisions, responsibilities, and outcomes, address shortcomings, and continuously improve.
6. Governance, Roles, and Responsibilities
The university will designate, by official decision, the entity responsible for business continuity, the oversight committee, and the delegation and escalation mechanisms. The following responsibilities are applied according to the jurisdictions and approved authorities of the relevant entities, without this policy superseding decisions regarding the formation of committees or delegations of authority.
a. Senior Leadership and Authorized Person
• Adopting the policy, organizational scope, objectives, and main directions for business continuity, in accordance with their authority.
• Providing the necessary resources and monitoring risks and constraints that affect readiness.
• Defining the authority of the response leadership, delegation, and alternates during disruptions.
b. Business Continuity Oversight Committee
• Overseeing the implementation of the system and reviewing business priorities, strategies, plans, and exercise results.
• Monitoring readiness indicators and corrective actions, and escalating matters requiring a decision to the authorized person.
• Coordinating the resolution of conflicts and dependencies between entities, within the limits of their approved authority.
c. Business Continuity Entity
• Preparing the methodology, forms, and annual program, and coordinating impact analysis and disruption risk assessment.
• Compiling and ensuring the integration of entity plans, and managing readiness and follow-up records.
• Coordinating training and exercises, monitoring the closure of corrective actions, and submitting reports. • Review the policy and submit updates for approval, ensuring that documents are accurate and available to stakeholders.
d.Colleges, Deanships, Departments, and Service Owners
• Appoint a Business Continuity Coordinator and a deputy, and define response and recovery teams.
• Inventory activities, resources, and dependencies, conduct impact analysis, and participate in risk assessment.
• Prepare, update, test, and allocate resources to the entity's continuity plans according to allocated budgets.
• Notify the relevant authority of changes, incidents, and constraints affecting business continuity.
e. Deanship of Information Technology and E-Learning
• Prepare and implement digital service continuity and technical recovery plans in coordination with system and service owners.
• Identify technical dependencies, availability strategies, backup and recovery methods, and alternative sites or environments.
• Test system and data recovery, verify the achievement of approved recovery objectives, and document the results.
• Support technical alternatives, e-learning, and remote work within approved permissions and controls.
f. Cybersecurity Management
• Identify and review cybersecurity resilience requirements for continuity and recovery, and assess cyber risks.
• Coordinating the response to cyber incidents and conducting security checks on systems and data before restoring them to service.
• Monitoring compliance with relevant national regulations and maintaining evidence and records according to approved procedures.
g. Supporting Entities and Internal Audit
The entities responsible for safety, facilities, human resources, finance, procurement, and media are responsible for providing the continuity requirements within their respective areas of responsibility. This includes site security, backup resources, contracts, and approved communication protocols. Internal audit independently evaluates the adequacy and effectiveness of the system according to the audit plan, without assigning system operation or approving exceptions to it.
h. University Staff, Students, and Contractors
Those concerned are obligated to follow the instructions communicated to them, participate in training and exercises according to their roles, report outages, and maintain confidentiality. Contractors are obligated to comply with the continuity, reporting, and recovery requirements stipulated in their contracts.
7. Establishing a Business Continuity Management System
1. The competent authority defines the system's context, scope, covered services, stakeholders, and their requirements.
2. Measurable objectives and an implementation plan are established, including responsibilities, resources, timelines, and follow-up deliverables.
3. A continuous cycle is implemented, encompassing planning, implementation, verification, correction, and improvement.
4. Readiness gaps and a plan to address them are documented, and remaining constraints or risks are escalated to the relevant authority for decision-making.
8. Business Disruption Impact Analysis
• Entities conduct a documented impact analysis of their activities in coordination with the relevant authority. This analysis is performed at least annually and upon significant changes.
• The analysis includes the long-term impact on education, testing, research, student services, financial and organizational obligations, safety, and reputation.
• For each priority activity, a maximum acceptable downtime, a recovery time target, a minimum acceptable operational time, and the resources required for resumption are defined.
• Data recovery point targets are defined based on business needs, in coordination with the deanship and data owners.
• The targeted recovery time must fall within the maximum acceptable downtime, taking into account the time required for service stabilization, and must be compatible with technical and operational capabilities. • Dependencies include people, sites, systems, data, facilities, suppliers, shared services, and peak academic periods.
• Analysis results are based on authorization, and uniform recovery times are not imposed on all activities without analysis.
9. Disruption Risk Assessment and Remediation
• Threats that could disrupt priority activities and resources are identified, including technical failures, cyber incidents, power and communication outages, site unavailability, or staff and supplier availability.
• Risk probability, impact, and the adequacy of existing controls are assessed and linked to the corporate risk register.
• Remediation options, responsible parties, and timelines are defined, and remaining risks are monitored according to risk appetite and authorized permissions.
• Reassessments are conducted in the event of incidents, material changes, or the emergence of new dependencies or threats.
10. Continuity Strategies and Solutions
Organizations select continuity solutions based on impact analysis and risk assessment, evaluating their feasibility, cost, and approving them to ensure they meet requirements. These solutions include, as needed:
• Providing and training replacements for critical tasks and maintaining the necessary knowledge and procedures. • Provide alternative work locations or arrangements and enable remote learning or working, in accordance with approved decisions.
• Provide alternative technical capabilities, restoreable backups, and adequate power and communication availability.
• Use controlled manual or temporary operating procedures, with transactions recorded and subsequently settled.
• Provide alternatives for critical suppliers, services, and materials, and minimize individual points of failure.
11. Business Continuity Plans
Each relevant entity shall develop a documented plan that integrates with corporate plans and technical and emergency recovery plans. At a minimum, the plan shall include:
1. Scope of the plan, priority activities, recovery objectives, and acceptable operational level.
2. Activation and escalation criteria, decision-making authority, roles, alternatives, and contact information.
3. Initial response procedures, situation assessment, deployment of alternatives, and resource allocation.
4. Dependencies and coordination requirements with internal, supplier, and external parties.
5. Procedures for restoring service, verifying readiness, settling backlogs, and returning to normal operations.
6. A mechanism for recording decisions, events, communications, implementation results, and review and testing schedules. Updated copies of plans and contact information are securely stored and accessible to relevant personnel in the event of a primary system failure, taking into account information classification and access permissions.
12. Continuity of Education, Research, and Student Services
• Academic bodies determine alternatives for teaching, assessment, examinations, and scheduling.
This is done in a manner that preserves academic integrity and equal opportunities, and is subject to approved academic decisions.
• Admission, registration, examination, and graduation periods, as well as deadlines whose disruption would directly harm students, are taken into consideration.
• Arrangements are made to protect research data, experiments, materials, and equipment that require special storage or operating conditions.
• Plans include essential student services, health, housing, and transportation services when they fall under university services, taking into account the needs of people with disabilities.
13. IT Disaster Recovery
• The Deanship develops plans to restore systems, data, and the supporting IT infrastructure for priority activities, prioritizing restoration based on dependencies.
• Recovery settings, access requirements, keys, licenses, and vendor information are securely and up-to-dately documented.
• Backup, copy protection, and appropriate isolation requirements are implemented in accordance with approved cybersecurity and data policies.
• Actual system and data recovery is tested, and the time and point of recovery achieved are measured against approved objectives.
• System restarts alone do not constitute service restoration. The owning entity verifies data integrity and operational feasibility in coordination with the Deanship and Cybersecurity.
14. Activating Plans, Response, and Communication
• Reports outages through approved channels, assessing their impact, scale, expected duration, and affected services.
• Plans are activated by a decision from the authorized entity upon fulfillment of activation criteria, documenting the decision time and scope, and notifying the relevant teams.
• Escalation levels are determined based on the impact of the outage, exceeding restoration objectives, threatening individual safety, or the extent of affected services.
• Specialized teams implement alternatives and restoration measures, monitor the situation, and update the response command at the intervals specified in the plan.
• The communication plan organizes messages, identifies those responsible for approval, determines dissemination channels and alternatives, and includes students, staff, suppliers, and regulatory bodies as needed.
• External statements are restricted to authorized entities, and communications maintain the accuracy and confidentiality of information while adhering to regulatory reporting obligations.
• An emergency situation does not justify exceeding cybersecurity or data protection requirements; any exceptional arrangements are documented and approved according to procedures. 15. Return to Normal Operations
A return to normal operations is determined by the authorized entity after verifying the stability of systems and facilities, the availability of resources, data integrity, and the acceptance of the service owner. Procedures include the orderly shutdown of alternatives, resolution of backlogs, verification of data completeness, and notification of stakeholders. A post-incident report is prepared outlining the impacts, decisions, actual times, lessons learned, corrective actions, responsible parties, and closure dates.
16. Suppliers and External Parties
• Critical services and resources provided by external parties are identified, and the suppliers' continuity capacity is assessed.
• Availability, reporting, recovery, testing, data protection, and access to necessary information requirements are included in contracts according to the nature of the service.
• The alignment of the supplier's commitments with the university's business recovery objectives is reviewed, and gaps and options for addressing them are documented.
• Arrangements are made to handle supplier failure or contract termination and to securely transfer the service and data.
17. Training, Awareness, Exercises, and Tests
• An annual training and awareness plan is developed, targeting coordinators, teams, leaders, and stakeholders according to their roles. • An annual plan for exercises and tests is adopted, encompassing priority activities and technical recovery plans. Additional tests are conducted when significant changes occur.
• Exercises vary, ranging from scenario reviews and simulations to technical tests, depending on the risks and readiness.
• Each exercise has defined objectives, success criteria, scope, responsible parties, and controls to minimize its impact on actual operations.
• Results, timelines, deficiencies, and corrective actions are documented, and the corrective actions are retested when necessary.
18. Document and Records Management
Policies, plans, and records are managed in terms of issuance, review, approval, distribution, accessibility, and archiving. Records include impact and risk analyses, strategies, plans, contact information, training, tests, incidents, and corrective actions. Retention periods and access permissions are defined according to approved regulations and policies, and sensitive operational details are protected from unauthorized disclosure.
19. Performance Indicators and Monitoring
The competent authority defines the calculation method, data source, responsible party, measurement frequency, and approved target for each indicator. Readiness reports are submitted to the supervisory committee. Indicators may include:
• The percentage of priority entities or activities that have completed an approved and up-to-date impact analysis.
• The percentage of priority activities covered by approved and up-to-date continuity plans.
• The percentage of exercises and tests conducted according to the approved plan.
• The percentage of recovery tests that met the required time, recovery point, and operational level targets.
• The percentage of team members who completed the required training.
• The percentage of corrective actions closed on time and the number of delayed actions.
• The actual downtime and frequency of priority services compared to approved requirements.
20. Review, Evaluation, and Improvement
A management review is conducted at least once a year, covering the results of indicators, tests, incidents, audits, changes in risk, and resources. Internal reviews are conducted according to an approved plan to verify the system's adequacy and the effectiveness of its implementation. Improvement decisions are documented in a plan that identifies those responsible, the resources required, deadlines, and the mechanism for verifying closure. Issues that are not feasible or delayed are escalated to the appropriate authority. 21. Exceptions
• The request for an exception, its justifications, scope, duration, effects, compensatory controls, and remediation plan must be documented.
• The request is reviewed by the competent authority and relevant parties, depending on the nature of the exception, and approved by the authorized official.
• An exception may not exempt one from a legal or regulatory obligation that is subject to application.
• Exceptions are recorded and reviewed upon completion.
Its duration may be extended or its causes changed, and it is not automatically renewed.
22. Compliance and Integration with Other Policies
Entities covered by this policy are bound by its provisions. Non-compliance will be addressed according to the university's approved regulations, bylaws, and procedures. This policy is integrated with risk management, cybersecurity, data protection, backup, emergency and safety, incident management, communication, procurement, and change management. Technical recovery plans do not replace business continuity plans, nor do continuity plans replace life-saving and emergency response procedures.
23. Review and Update
This policy will be reviewed at least once a year, and whenever new regulatory requirements are issued, or when significant changes occur in the university's operations, structure, systems, or suppliers, or when a significant disruption occurs, or when audit and testing results necessitate an update. The competent authority will coordinate the review with the relevant parties, submit the amendments for approval according to its authority, then circulate the approved version and archive previous versions.
24. Regulatory References
Refer to the latest applicable versions of the following references, according to their scope of application, using international standards as a methodological guide. However, adherence to these international standards does not constitute proof of conformity:
• Digital Government Risk Management and Business Continuity Controls, issued by the Digital Government Authority.
• Digital Transformation Core Standards and related Business Continuity Guidelines, issued by the Digital Government Authority.
• Cybersecurity Core Controls and related controls, according to their scope of application, issued by the National Cybersecurity Authority.
• Personal Data Protection System, its regulations, and related regulatory requirements.
• Requirements and instructions issued by the Ministry of Education and relevant emergency and safety authorities, as applicable.
• ISO 22301 for Business Continuity Management Systems and ISO 31000 for Risk Management.
• Internal policies, regulations, decisions, and procedures adopted at the University of Hail.
Links to the main national references:
https://dga.gov.sa | https://nca.gov.sa/ar/regulatory-documents/controls-list/ecc/
25. Adoption and Implementation
This policy shall enter into force upon its adoption by the authorized official at the University of Hail. The competent authority shall oversee its implementation, monitoring, and updating in coordination with relevant entities, each within its respective jurisdiction.