Book a consultation
GCC regulations / Law or regulation

CST Cloud Computing Regulatory Framework and cloud provider registration

Registration and classification of cloud service providers in Saudi Arabia, from Qualifying to Class C, which decides the data and sectors you can serve.

Talk to a consultant Start with a gap assessment

The Communications, Space and Technology Commission (CST, formerly CITC) regulates cloud computing in Saudi Arabia through its Cloud Computing Regulatory Framework and the provisioning regulations for cloud service providers. Providers that control cloud data centres or critical cloud infrastructure in the Kingdom register with CST, and their class (Qualifying, A, B or C) decides the data classification levels and customer sectors they may serve.

What changes with each class

Higher classes allow more sensitive data, up to secret and top-secret government data under Class C, and come with stricter expectations on hosting, security, governance and personnel. Security requirements are closely linked to the NCA Cloud Cybersecurity Controls, and personal data obligations follow the PDPL.

How we help

We confirm the class you need for your target market, assess you against the CST framework, NCA CCC and ISO/IEC 27017 together, help remediate gaps and prepare the evidence for registration. Requirements are set and updated by CST, so we always confirm current criteria with the regulator.

Who it is for

  • Cloud and data centre providers operating infrastructure in Saudi Arabia
  • Hyperscale and regional cloud providers entering the Kingdom
  • SaaS and managed service providers serving Saudi government or regulated customers

What you gain

  • A clear view of which class you need for your target customers
  • Controls aligned with NCA CCC and ISO/IEC 27017 so one programme serves all three
  • Access to government, financial and other regulated sector workloads

How we get you compliant

  1. Applicability and target class

    Confirm whether you must register and which class fits the data levels and sectors you want to serve.

  2. Gap assessment

    Assess hosting, security, governance and customer protection obligations against the framework and NCA CCC.

  3. Remediation

    Close gaps in data location, access, encryption, incident handling and contracts.

  4. Registration support

    Prepare the evidence and documentation for the registration application and respond to follow-up questions.

  5. Ongoing compliance

    Keep controls and evidence current as your services, data levels and the rules change.

CST Cloud Class A, B, C questions

What do Class A, B and C mean?
The classes set which data you may host. As published by CST: Qualifying covers individuals and the private sector, excluding finance; Class A covers public data for all sectors; Class B adds confidential data; Class C covers public, confidential, secret and top-secret data for individuals, the private, non-profit and government sectors.
Who has to register with CST?
Providers that control a cloud data centre or critical cloud infrastructure in the Kingdom and use it to provide cloud services. SaaS providers that run on a registered platform should still check what their own customers and contracts require.
How does this relate to NCA CCC?
CST registers and classifies the provider; the NCA Cloud Cybersecurity Controls set the security requirements for providers and tenants serving government and critical infrastructure. Most providers aiming for higher classes need both.

Ready to start on CST Cloud Class A, B, C?

Tell us which standard or customer requirement you are facing. In a free 30-minute call we will outline the gaps, a realistic timeline and what it will take to be audit-ready.

Book a free consultation Try the standard finder