CST Cloud Security: Compliance Requirements

The Communications, Space & Technology Commission (CST) oversees cloud computing policy in the Kingdom. Alongside NCA — which issues Cloud Cybersecurity Controls (CCC) — CST has policy and licensing authority. Organizations using cloud to store sensitive or government data need to understand both frameworks.

Data residency: government data and data classified as sensitive are typically required to remain within Kingdom borders. Local cloud regions — such as AWS Riyadh and Oracle Jeddah — satisfy this requirement. Hosting in UAE or European regions may not suffice for government entities.

Hosting government and critical data within the Kingdom has become a regulatory requirement — the choice between local and regional cloud affects compliance and appeal for government work.

Cloud provider classification: CST and its predecessors have adopted classifications for cloud providers based on security and compliance. Locally accredited providers undergo assessment. Choosing an unclassified or non-accredited provider may block access to government contracts.

Shared responsibility model: the cloud provider is responsible for physical infrastructure security — the organization is responsible for security configurations, identity management, data encryption, and application security. NCA CCC details both parties' responsibilities. Common error: assuming "the cloud is fully secure" without reviewing configuration.

Government cloud requirements: government entities face stricter controls — local hosting when handling sensitive data, contract terms covering compliance and security, and periodic vendor assessment. Contracts with international cloud providers need exceptions or additional safeguards.

Cross-border data hosting: transferring personal data outside the Kingdom is subject to PDPL — whether cloud or processing. Processing agreements, standard contractual clauses, and transfer impact assessments are required. CST, NCA, and SDAIA intersect at cloud computing — a unified compliance program covers all three.