# CST Cloud Class A, B, C: CST Cloud Computing Regulatory Framework and cloud provider registration (CST CCRF)

> Registration and classification of cloud service providers in Saudi Arabia, from Qualifying to Class C, which decides the data and sectors you can serve.

URL: https://securei3.com/standards/cst-ccrf/
Category: GCC regulations: Law or regulation
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


The Communications, Space and Technology Commission (CST, formerly CITC) regulates cloud computing in Saudi Arabia through its Cloud Computing Regulatory Framework and the provisioning regulations for cloud service providers. Providers that control cloud data centres or critical cloud infrastructure in the Kingdom register with CST, and their class (Qualifying, A, B or C) decides the data classification levels and customer sectors they may serve.

## What changes with each class

Higher classes allow more sensitive data, up to secret and top-secret government data under Class C, and come with stricter expectations on hosting, security, governance and personnel. Security requirements are closely linked to the NCA Cloud Cybersecurity Controls, and personal data obligations follow the PDPL.

## How we help

We confirm the class you need for your target market, assess you against the CST framework, NCA CCC and ISO/IEC 27017 together, help remediate gaps and prepare the evidence for registration. Requirements are set and updated by CST, so we always confirm current criteria with the regulator.

## Who it is for

- Cloud and data centre providers operating infrastructure in Saudi Arabia
- Hyperscale and regional cloud providers entering the Kingdom
- SaaS and managed service providers serving Saudi government or regulated customers

## Benefits

- A clear view of which class you need for your target customers
- Controls aligned with NCA CCC and ISO/IEC 27017 so one programme serves all three
- Access to government, financial and other regulated sector workloads

## How Secure iQube helps

1. **Applicability and target class**: Confirm whether you must register and which class fits the data levels and sectors you want to serve.
2. **Gap assessment**: Assess hosting, security, governance and customer protection obligations against the framework and NCA CCC.
3. **Remediation**: Close gaps in data location, access, encryption, incident handling and contracts.
4. **Registration support**: Prepare the evidence and documentation for the registration application and respond to follow-up questions.
5. **Ongoing compliance**: Keep controls and evidence current as your services, data levels and the rules change.

## Frequently asked questions

### What do Class A, B and C mean?

The classes set which data you may host. As published by CST: Qualifying covers individuals and the private sector, excluding finance; Class A covers public data for all sectors; Class B adds confidential data; Class C covers public, confidential, secret and top-secret data for individuals, the private, non-profit and government sectors.

### Who has to register with CST?

Providers that control a cloud data centre or critical cloud infrastructure in the Kingdom and use it to provide cloud services. SaaS providers that run on a registered platform should still check what their own customers and contracts require.

### How does this relate to NCA CCC?

CST registers and classifies the provider; the NCA Cloud Cybersecurity Controls set the security requirements for providers and tenants serving government and critical infrastructure. Most providers aiming for higher classes need both.

Related: https://securei3.com/standards/nca-ccc/, https://securei3.com/standards/nca-ecc/, https://securei3.com/standards/iso-27017/, https://securei3.com/standards/ksa-pdpl/

Contact: https://securei3.com/contact/: info@securei3.com