Back to Top
 
Information Technology
Contact IT Support

 

 

System & Data Classification

Use this page to classify systems by criticality, business impact, and the data they process or store. If a system is designated as Nationally Critical or University Mission Critical, classify it as Critical.

System Criticality and Business Impact Classification

Select the rating that best reflects the overall consequence if the application becomes unavailable. Consider impacts on operations, health and safety, environment, reputation, finances, and legal or regulatory compliance. Select the highest impact level among these domains.

LevelDefinition
Critical Systems performing University Mission Critical activities or designated as Nationally Critical. Immediate resumption and recovery are required to safeguard University operations, reputation, strategic objectives, or national obligations.
Classify as Critical if any of the following apply:
  • Negative impact on the Kingdom's reputation and public image
  • Loss of life or serious safety impact
  • Unauthorized disclosure or alteration of data classified as Highly Restricted, or significant volumes of Restricted data
  • Severe impact on University operations, finances, reputation, legal compliance, or strategic objectives
High Activities considered critical to University operations and the broader community. Resources are to be prioritized for resumption and recovery following Mission Critical activities.
Medium Disruption may not be immediately noticeable. Productivity and performance may decline over time, which could negatively affect University objectives.
Low The impact of temporary delay or disruption to these activities is considered low.

Important: Any system that stores or processes data classified as Highly Restricted must be classified as Critical, regardless of other factors.

Data Classification

Classify the data processed or stored on each system in accordance with the Data Classification Procedure.

ClassificationCriteria
Highly Restricted Disclosure causes severe damage to any of the following:
  • KAUST strategic and financial interests, or activities of the Board of Trustees or Executive Committees
  • The reputation of the country
  • Privacy of political or University VIPs
  • Operational efficiency of security or intelligence operations of military forces
  • Environment or natural resources (catastrophic damage)
Or severe damage to
  • The national interest or economy
  • National infrastructure or government functions
  • Health and safety at massive scale
  • Diplomatic relations and political affiliations
Restricted Disclosure causes adverse damage to any of the following:
  • KAUST, its operations, finances, or assets
  • The national interest or the reputation of the country
  • Diplomatic relations and political affiliations
  • Operational efficiency of security or intelligence operations of military forces
  • The national economy
  • Significant harm or injury impacting the lives of individuals
  • Long-term damage to the environment or natural resources
Or adverse damage to
  • National infrastructure or government functions
  • Health and safety at massive scale
  • KSA organizations (for example, bankruptcy or inability to perform duties)
  • Investigation of major cases such as terrorism funding
  • Competitive abilities
Internal Disclosure affects to some extent:
  • KAUST, its operations, finances, or assets
  • Government entities' operations and assets
  • The KSA economy
  • Government entities' financial and competitive status (limited loss)
Or
Short-term damage to the environment or natural resources.
Public Minimal to no impact on national interest, KAUST, individuals, or the environment.

References

Last reviewed: October 2025