خريطة السحابة السعودية.

CST

Communications, Space and Technology Commission

Cloud Computing Services Provisioning Regulations (in force 10 Oct 2023)

Providers that control the data centre or critical infrastructure of a cloud system must register with CST. Registration classes (Qualifying, A, B, C) determine which data classifications and which sectors — including government — a provider may serve. CST publishes the register.

CST — Regulation 1482CST — cloud computing registrationCST — registered providers

NCA

National Cybersecurity Authority

Essential Cybersecurity Controls ECC-2:2024 · Cloud Cybersecurity Controls CCC-2:2024

Applies to government entities and to private entities owning, operating, or hosting critical national infrastructure — from both the provider and the tenant perspective. A buyer in scope will flow these controls down to its suppliers by contract.

NCA — CCCNCA — ECC

SDAIA

Saudi Data & AI Authority

Personal Data Protection Law (fully enforceable since 14 Sep 2024) · Regulation on Personal Data Transfer Outside the Kingdom (Sep 2024)

Cross-border transfer of personal data needs a lawful basis plus safeguards (standard contractual clauses, binding common rules, or accreditation); no adequacy list had been published at the date checked. Controller and processor roles must be explicit in the hosting chain.

Mayer Brown — PDPL transfer regulations (2024)IAPP — PDPL first anniversary

NDMO

National Data Management Office (under SDAIA)

National Data Governance Interim Regulations, incl. Data Classification Policy

Government data must be classified — Top Secret, Secret, Confidential, or Public — and the classification drives which provider class and hosting arrangement is acceptable.

NDMO — policies (PDF)

NIC

National Information Center (under SDAIA)

Government Secure Network (GSN) and Government Service Bus

A non-government company may connect to the GSN only with a government entity’s approval and the service provider’s approval, under a standard SLA.

SDAIA — GSN & GSB

SAMA

Saudi Central Bank

Cyber Security Framework · Rules on Outsourcing

Financial institutions need SAMA approval before using cloud services, and explicit approval for cloud located outside the Kingdom.

SAMA outsourcing rules — GCP mapping

MISA

Ministry of Investment

Investment registration (replaces licensing) · Regional Headquarters programme

A subsidiary or branch is a real option: investment registration review takes up to 10 days per MISA. The RHQ rule affects eligibility for government tenders on Etimad.

MISA — FAQMISA — RHQ

MoF / Etimad

Ministry of Finance · Etimad portal

Government Tenders and Procurement Law (M/128, 2019) · local-content rules

Etimad is the single gateway to government tenders. A foreign supplier can register without a Saudi CR via the Foreign Supplier route with a home-country licence and a local representative, but most tenders in practice expect a Saudi CR or MISA registration, and local-content scoring increasingly decides awards.

US ITA — selling to the Saudi public sector

MCIT

Ministry of Communications and Information Technology

Cloud First Policy (2020)

Government entities must consider cloud first for new IT investment. The policy exempts SAMA, MoD, PSS, MoI, and NCA.

MCIT — Cloud First Policy (PDF)