A provider introducing a hosted service
Confirm the service’s regulatory status before choosing an assessment checklist. Trace management access, tenant boundaries, monitoring and subcontracted infrastructure to named control owners.
Saudi regulatory frameworks
Communications, Space & Technology Commission
CST Cybersecurity Regulatory Framework Readiness
Assess CST CRF applicability and strengthen ICT service security through control implementation, operational ownership and evidence preparation.
Published Cybersecurity Regulatory FrameworkSources reviewed: 4 November 2026
Understand the requirement. Connect it to operations.
CST publishes a Cybersecurity Regulatory Framework for Service Providers in the Information and Communications Technology Sector. The official regulation page identifies decision 424/1442 dated 15 September 2020 and describes a sector-focused framework intended to raise cybersecurity maturity. Its principal audience includes organizations licensed or registered by CST and entities subject to CST’s ICT-sector regulatory oversight. This makes it distinct from a generic cybersecurity checklist for all businesses operating in Saudi Arabia.
IRIS Technology can help relevant service providers connect regulatory readiness to the services they actually operate. Begin with applicability and service boundaries, then assess governance, technical safeguards, operating processes and supporting evidence. A gap assessment should explain the risk behind each finding and identify practical control implementation actions. The examples below are suggested implementation activities; mandatory controls, assigned expectations and reporting arrangements must be confirmed against the applicable official text and current CST directions.
Confirm applicability before choosing controls.
Confirm the legal entity, licensed or registered activities, service categories and any specific regulatory instructions. A supplier supporting a regulated provider may have contractual obligations without being directly regulated in exactly the same way. Do not assume all enterprise customers consuming ICT services inherit the provider’s full framework obligations, or that one service registration automatically establishes the scope of every group company.
Assess relevant interfaces with NCA cybersecurity requirements and other applicable regimes rather than assuming the CST framework replaces them. For cloud services, distinguish the Cybersecurity Regulatory Framework from CST’s cloud-service provisioning regulations and relevant NCA Cloud Cybersecurity Controls. Document provider, customer and subcontractor responsibilities. Avoid using unverified control counts or edition claims when the current source record and institution-specific directions have not been reconciled.
Turn requirements into implementation and evidence.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Applicability and governance | Identify regulated services, decision owners and applicable instructions. | Scope record, requirement map and approved responsibilities. |
| Service and risk visibility | Trace assets, information, management interfaces and dependencies. | Service inventory, architecture and prioritized risk register. |
| Protective control implementation | Review identity, privileged access, segmentation and secure configuration. | Access reviews, baseline checks and exception decisions. |
| Security operations and resilience | Connect monitoring, incident handling and recovery to service impact. | Operational records, exercises and recovery validation. |
| Third-party accountability | Review subcontracted services and shared operational responsibilities. | Supplier assessments, agreements and evidence ownership. |
What this looks like in practice.
A managed-service dependency
Review how incident escalation and evidence collection cross organizational boundaries. A provider’s documented procedure may still fail if a subcontractor cannot supply the required records or support recovery.
From readiness assessment to working controls.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Assess and prioritize
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Design the improvements
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Implement and validate
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Handover and sustain
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Agree concrete deliverables.
- A scope and applicability record with assumptions and responsibilities.
- A gap/risk register and prioritized remediation roadmap.
- Control mapping, architecture recommendations and operating procedures.
- An evidence register, agreed validation results and handover material.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
Common questions.
Does the CST framework apply to every Saudi business?
No universal assumption is justified. The official page focuses on licensed or registered organizations and those subject to CST’s sector oversight. Confirm the entity and regulated activities.
Is this the same as CST cloud regulation?
No. The cybersecurity framework and cloud-service provisioning regulations are distinct instruments. A cloud provider may need to assess multiple applicable requirements and keep their references separate.
Does CST CRF replace NCA requirements?
Do not assume it does. Determine the applicable NCA requirements, sector directions and any reporting relationships for the provider’s actual classification and services.
What should providers prepare for a gap assessment?
Prepare registrations or licenses, service catalogs, architecture diagrams, asset and supplier records, security policies and prior findings. Agree which team owns evidence for each service boundary.
Can IRIS guarantee regulatory approval?
No. IRIS can support readiness, remediation and evidence preparation within an agreed scope. Regulatory interpretation, supervisory decisions and formal acceptance remain with the competent authority.
Start with the official sources.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Related frameworks and requirements
Define the right scope for your organization.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness