Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Telecommunications & ICT › Cybersecurity Regulatory Framework (CRF) for ICT Service Providers (Second Version)

Cybersecurity Regulatory Framework (CRF) for ICT Service Providers (Second Version)

CST cybersecurity framework for ICT service providers

Type	Framework
Code	CRF
Issuing authority	Communications, Space & Technology Commission (CST)
Framework	Telecommunications & ICT
Tier	Rules, controls & standards
Legal status	In force
Instrument number	Communications, Space and Technology Commission
Version	2
Dates	Second Version, October 2023; replaces the 2020 first edition (decision 424/1442)
Last verified	2026-10-20

The Cybersecurity Regulatory Framework (CRF) for ICT service providers is CST's cybersecurity baseline for the providers it licenses. The hosted copy is the Second Version (October 2023).

• Appears to replace the first CRF, issued by CITC with the NCA under decision 424/1442 (15 September 2020).
• The Document-413 record on the CST portal relates to that 2020 decision, not to the Second Version.
• Read with CST's Regulations for Cybersecurity Operations in the ICT Sector (decision 490/1444).
• Read with the NCA's Essential Cybersecurity Controls (ECC), Cloud Cybersecurity Controls (CCC) and Non-CNI Cybersecurity Controls (NCNICC).
• The hosted PDF has no text layer.

Documents

• Hosted official text (PDF, English)
• Official source (www.cst.gov.sa)

In this framework

• Telecommunications and Information Technology Act
• Organisation of the Communications, Space and Technology Commission (as amended)
• Implementing Regulations of the Telecommunications and IT Act
• Regulations for Curbing Spam Messages and Calls (RC01 v3)
• Regulations of User Rights Protection Rules
• Regulations for Providing Digital Content Platform Services
• Internet of Things Regulations (RT18 v3)
• Telecom Infrastructure Risk Management Regulations (v2)
• Space Sector Regulations and Guidelines (draft)
• CST licensing and registration (index)

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21