Cybersecurity Policy
Protecting confidentiality, integrity & availability
1.1 Introduction and Objectives
Wellspring University is committed to a robust cybersecurity posture protecting digital assets, information systems, and community privacy in compliance with NDPA 2023, Cybercrimes Act 2024, and NUC guidelines.
Prevent unauthorized access
Recover with minimal disruption
Laws & regulations
Security-conscious culture
1.3 Identity & Access Management
| Phase | Action | Responsible |
|---|---|---|
| Joiner | Registrar request → ICT provisions email, systems, biometrics + MFA | Registrar, ICT |
| Mover | Role change notification → Access review & permission update | Registrar, ICT |
| Leaver | Same-day suspension, full access revocation, device wipe | Registrar, ICT |
Standards: MFA mandatory for staff. Shared accounts prohibited. Privileged accounts reviewed quarterly.
1.6 Incident Response Framework
Ransomware, massive breach, CNII compromise — Report within 72hrs to ngCERT & NDPC
Admin access, targeted phishing, significant exfiltration
Individual malware, minor data issues
Suspicious logins, minor violations
5 Phases: Detection → Containment → Investigation → Eradication & Recovery → Post-Incident Review (within 5 days)
1.7 Data Classification & Protection
| Level | Examples | Protection |
|---|---|---|
| Public | Website, marketing | Standard |
| Internal | Staff memos, operational | Access controlled |
| Confidential | Student records, research | Restricted sharing |
| Restricted | Financial, biometrics, medical | Encryption + DPO approval |
DPO designated. Breach assessment within 72 hours. NDPC registration required.
1.9 Enforcement
Non-compliance: Access suspension, disciplinary action, or legal proceedings under Nigerian law. Policy reviewed annually or after major incidents.
ICT Policy
Strategic governance of technology resources
Core Objectives
- ● Strategic Alignment with University goals
- ● Efficiency & productivity optimisation
- ● Innovation in teaching & research
- ● Accessibility for all authorised users
- ● Sustainability of infrastructure
Critical Enterprise Systems
Business Continuity & Disaster Recovery
| Tier | Systems | RTO | RPO |
|---|---|---|---|
| Tier 1 | Email, SIS, Network Core, CBT | 4h | 1h |
| Tier 2 | LMS, HR/ERP, Registrar | 8h | 4h |
| Tier 3 | File Storage, Secondary Apps | 24h | 12h |
Weekly full + daily incremental backups. Monthly air-gapped copies. Quarterly restore tests + biannual DR simulations.
IT Support Matrix
30 min / 4 hrs
2 hrs / 8 hrs
4 hrs / 24 hrs
1 day / 3 days
Artificial Intelligence Policy
Ethical, responsible & transparent AI use
Academic Integrity Rules
Ethical AI Framework
Mandatory AI literacy and ethical training for faculty and researchers.
E-Learning Policy
Quality online & blended learning aligned with NUC
Key Standards
- • Curriculum alignment & equivalent learning outcomes
- • Sound instructional design with diverse activities
- • Faculty digital literacy & timely student engagement
- • Secure, accessible LMS (Moodle) with WCAG compliance
- • Regular evaluation, peer review & NUC compliance checks
