Choosing a cloud provider
Evaluate the exact service, its contractual coverage and relevant evidence. Avoid relying on a provider's name or unrelated registration statement.
All frameworks & requirements
Communications, Space & Technology Commission
CST Cloud Regulations Readiness
Review Saudi cloud service provisioning obligations, provider arrangements, contracts and responsibilities alongside cybersecurity and privacy requirements.
Cloud Computing Services Provisioning Regulations, version 4Sources reviewed: 4 November 2026
Understand the requirement. Connect it to operations.
CST's Cloud Computing Services Provisioning Regulations address the rights and obligations of cloud service providers and users. Decision 506/1445 approved version 4 and superseded the older Cloud Computing Regulatory Framework version 3. Using the correct document matters when defining scope or reviewing supplier claims.
An effective review connects the commercial arrangement with technical delivery. Understand what is provided, where responsibilities sit, how support works and what happens when the service changes or ends. Registration evidence and security evidence answer different questions.
Confirm applicability before choosing controls.
Identify the organization's role as provider, customer, reseller or managed-service participant and confirm the obligations for that role. Check provider registration or qualification requirements against current CST regulations and guides rather than assuming one category covers every service.
Review cloud arrangements with applicable NCA controls, personal-data protection and sector requirements. A CST registration does not establish blanket cybersecurity compliance or resolve every location, access and transfer question for a specific customer workload.
Turn requirements into implementation and evidence.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Provider and service status | Check provider, service scope and relevant registration evidence. | Current supplier records and documented scope checks. |
| Clear service commitments | Review service description, responsibilities, support and changes. | Approved contract, service levels and change procedures. |
| Data and access arrangements | Map locations, access paths, customer controls and dependencies. | Data-flow diagrams and responsibility decisions. |
| Incident and continuity coordination | Agree escalation, evidence availability and recovery ownership. | Contacts, procedures and joint validation results. |
| Exit and termination | Plan usable data return, transition and disposal arrangements. | Exit plan, export tests and documented closure evidence. |
What this looks like in practice.
A managed cloud contract
Make boundaries between platform provider, integrator and customer explicit. Incident handling, configuration changes and data return can otherwise fall between separate contracts.
From readiness assessment to working controls.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Assess and prioritize
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Design the improvements
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Implement and validate
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Handover and sustain
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Agree concrete deliverables.
- A scope and applicability record with assumptions and responsibilities.
- A gap/risk register and prioritized remediation roadmap.
- Control mapping, architecture recommendations and operating procedures.
- An evidence register, agreed validation results and handover material.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
Common questions.
Is the old Cloud Computing Regulatory Framework current?
CST's approval decision states that version 4 of the provisioning regulations supersedes version 3 of the older framework. Consult the current official publication and guides.
Are CST regulations and NCA CCC interchangeable?
No. Their purposes and obligations differ. An arrangement may need both regulatory provisioning review and cybersecurity-control assessment.
Does provider registration approve every workload?
No. Confirm the actual provider/service scope and assess your own data, sector, security and contractual requirements. Registration alone is not a workload risk decision.
Can IRIS guarantee registration?
No. The competent authority controls registration and qualification decisions. Support can identify requirements, evidence gaps and technical dependencies within an agreed scope.
What should we review before signing?
Review provider status, service boundaries, terms, access, data arrangements, incident coordination, continuity and exit. Involve procurement, legal, business and technical owners.
Start with the official sources.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Related frameworks and requirements
Define the right scope for your organization.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness