Purpose

Set minimum security expectations for people, systems, and data used by Ghida Alsultan Co, across cloud and SaaS systems, to preserve confidentiality, integrity, and availability.

Policy

• Applies to all employees, contractors, and vendors accessing organizational data or systems (Internal, Confidential, or Restricted).
• Covers SaaS platforms (e.g., Odoo cloud), networks, and endpoints.
• Purpose: protect confidentiality, integrity, and availability of organizational information assets.
• Standards & references: ISO/IEC 27001/27002, NIST CSF, and applicable laws (e.g., GDPR, KSA PDPL, PCI DSS, local labor/finance records).

Note: See the “Top 50” and “Follow‑ups” source questionnaires for the detailed prompts this policy is based on.

Purpose

Define ownership, approval, and review responsibilities so policy stays current and enforceable.

Policy

• Maintain a current list of covered systems, owners, and periods in the Systems table.
• Keep security and privacy commitments aligned with vendor contracts and local laws.

Based on your answers: Department = IT Department of Ghida Alsultan Co; Owner = Ghida Alsultan IT Department; Approvers = IT/COO/CEO.

Policy & Procedure

1. The person who needs a change submits an email request to the IT Manager.
2. The IT Manager reviews the request, studies its feasibility and cost.
3. If the change is viable, the IT Manager raises the request to the Chief Operating Officer (COO) for approval.
4. If the COO approves, the change is implemented by the IT team or outsourced if needed.

Purpose

Establish a structured approach to identifying, evaluating, and mitigating risks to information systems and data.

Policy

• Risk assessments are performed annually and after major system updates or changes.
• The IT Department leads risk assessments using recognized methodologies (ISO 27001).
• Assessments include asset identification, threat and vulnerability analysis, risk evaluation, and mitigation planning.
• Findings are documented in a risk register and reported to management; high risks require mitigation plans and follow-up.
• Risk assessment results inform updates to policies, controls, and incident response plans.

Risk assessments are scheduled once a year or after major updates, ensuring ongoing risk management and compliance.

Purpose

Describe acceptable use of company IT resources to reduce misuse, data loss, and operational risk.

Policy

• Use company systems for business; limited personal use is permitted when it does not interfere with duties, consume excessive resources, or violate policy or law.
• Do: use approved systems, protect credentials, report incidents promptly (Incident Report form), and follow data handling rules.
• Don’t: share passwords, install unapproved software, disable or bypass security controls, or misuse company data/systems.
• Monitoring: company may monitor usage consistent with local laws and contracts.

Adapted from policy_full.html: Acceptable Use statement.

Purpose

Ensure people get appropriate access for their role and lose it when no longer needed.

Policy

• Unique identities are used across systems (email ID where supported; employee ID for POS). Accounts are created on join and terminated when HR notifies IT.
• Onboarding/offboarding: currently manual via IT form; no automation with HR. Deprovisioning occurs upon HR notification.
• User identities are local to each application and created manually.
• Access reviews: conducted every 6 months by the relevant owners; last period had new joiners only, no privilege changes.
• Shared accounts (e.g., Finance): must be documented with owners and usage scope (currently 4 users share 2 accounts, in pairs).

Based on your answers: local/manual accounts; 6‑monthly reviews; shared accounts in Finance.

Purpose

Rely on platform password settings that balance usability and security.

Policy

• Use platform defaults for password complexity; Odoo enforces "3 of 4" character classes — at least three of uppercase A‑Z, lowercase a‑z, digits 0‑9, and symbols (e.g., ! @ # $ %).
• We rely on platform enforcement; no additional overlay (e.g., custom password filter) is applied today.
• System‑to‑system secrets are managed per application; no centralized secrets manager at present.

Based on your answers: accept platform defaults; Odoo enforces 3‑of‑4 (upper, lower, number, symbol).

Purpose

Maintain awareness of devices and handle lost/stolen cases to reduce data exposure risk.

Policy

• Asset inventory is recorded in the Assets module within the ERP.
• BYOD allowed for top management for report viewing; device use must follow Acceptable Use.
• FDE/EDR are not required at this time; most systems are SaaS and devices are used primarily for access.
• Lost/stolen devices are reported using the Lost/Stolen Device Report form in the Forms section.

Based on your answers: ERP asset module; no EDR/FDE requirement; limited BYOD; lost/stolen reported via form.

Purpose

Define baseline controls for network access and connectivity.

Policy

• Internet access is via Fortinet firewall and switches; no static public IPs; used primarily for cloud/SaaS access and browsing.
• No VPN or remote admin is required; business systems are cloud/SaaS and accessed over the internet.
• No inbound database or service ports are exposed to the internet; all business systems are vendor‑hosted SaaS.
• Firewall settings are the platform defaults and rarely changed.
• Wireless uses WPA2 security; guest devices share the same NAT (no separate guest VLAN).
• Firewall is configured to immediately block the source after a single failed connection/authentication attempt.

Based on your answers: Fortinet edge; no VPN; defaults active; WPA2; guests on same NAT; no inbound service ports exposed (cloud/SaaS only); block on first failed attempt.

Purpose

State the current approach to protecting data at rest and in transit, and how long backups are kept.

Policy

• Encryption: rely on SaaS provider defaults for data at rest and in transit.
• Retention & secure deletion: business data retention is managed within the SaaS platforms per vendor capabilities and contract terms.
• For departing employees, a backup of the assigned device is taken and retained under IT custody.

Based on your answers: provider‑managed encryption; SaaS‑managed data retention; leaver device backups under IT custody.

Purpose

Ensure the ability to recover critical services and data within acceptable timeframes.

Policy

• SaaS/cloud products (Odoo, Dgtera POS): the provider is responsible for platform backups and availability.
• Access to any locally held backups (e.g., leaver device images): IT Manager only.
• Restore/recovery testing occurs during day‑to‑day maintenance as needed; DR Quick Action and Backup Test forms are available.

Based on your answers: SaaS/cloud provider responsibility for backups and availability; RTO 4h/RPO 24h; IT Manager access to local backups; tests ad‑hoc.

Purpose

Provide a simple path to report and respond to incidents to reduce impact.

Policy

• Incidents are raised via the ticketing system and handled by the IT team; in emergencies, users may call an IT member to expedite resolution.
• IR plan: a full IR playbook is desired and not yet documented; until then, use the Incident Report form and team coordination.

Based on your answers: full playbook requested; ticket/phone support.

Purpose

Explain how IT Support tickets are prioritised, so requesters know what priority to expect for a given issue and what response time comes with it.

How Priority Is Determined

• Covers tickets raised through the IT Support form at ticket.ghidas.com, across all brands (main concept, TNDR, Pizza), branches, factory, warehouse, and office locations.
• Priority reflects three things: category (which system), status (how broken it is), and scope (how much of the branch’s ability to sell or operate is affected right now).
• Urgent describes live service — selling, ordering, kitchen operations — stopped for a whole branch. A single device with a backup, a slow app, or a personal inconvenience falls into a lower band.
• Tickets are easiest to place correctly when the description states the actual impact, for example “2 of 5 tills down” rather than “urgent, please help”.

Priority Matrix

Issues that are not listed sit at the priority of the closest equivalent row; where that is unclear, IT makes the judgment call.

Response & Resolution SLA

Response and resolution times are targets, measured from the point a ticket is confirmed at its priority.

Source: IT Ticket Priority Policy (IT Operations). The matrix and SLA targets are reviewed quarterly, or sooner when a new system category is added to the IT Support form.

Purpose

Capture minimal expectations for vendor due diligence aligned with current practices.

Policy

• Vendor due diligence: no formal assessment performed today; rely primarily on contract review at signing for security/privacy clauses.
• Use the Vendor Security Checklist in Forms for future onboarding.
• API keys are stored in databases as implemented by applications.

Based on your answers: no formal vendor assessment; contracts reviewed; API keys in DB.

Purpose

Define basic physical safeguards and training expectations.

Policy

• Access controls: fingerprint device and cameras in use; camera footage retained ~30 days; biometric logs sync to BioTime server continuously.
• Removable media are not restricted at this time.
• Training is delivered 1:1 by IT using a checklist with employee sign‑off; annual policy review by IT Manager and upper management.

Based on your answers: fingerprint/camera in place; removable media open; training is 1:1 with sign‑off; annual governance review.

Purpose

Provide simple checklists and templates to operationalize the policy and collect evidence for audits.

Policy

• Use the embedded forms for incidents, access requests, shared accounts, DR checks, backup tests, vendor checklist, and lost/stolen device reporting.
• Forms may be exported as JSON or printed for signatures.

Use these forms to operationalize the policy. Submit digitally (export) or print for signatures. Required fields are marked.