Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Cloud & Data Centres › Cloud provider registration classes (Qualifying, A, B, C)

Cloud provider registration classes (Qualifying, A, B, C)

Which CST class a cloud provider needs, by data classification

Type	Instrument
Issuing authority	Communications, Space & Technology Commission (CST)
Framework	Cloud & Data Centres
Tier	Rules, controls & standards
Legal status	In force
Instrument number	Communications, Space and Technology Commission
Dates	Set by the Cloud Computing Services Provisioning Regulations v4 (in force 10 October 2023)
Last verified	2026-10-20

Cloud service providers register with CST in one of four categories under the Cloud Computing Services Provisioning Regulations v4. The category depends on the most sensitive data classification the provider's customers will host.

• Qualifying: transitional registration while a provider works towards a full class; no government customers.
• Class A: public data.
• Class B: data up to restricted.
• Class C: data up to secret and top secret, with CST approval for those levels.
• CST's Guide for Cloud Computing Service Providers sets the evidence for each class, rising from Tier II facility certification or ISO/IEC 27001 (Class A) to Tier III (Class B) and further approvals (Class C).
• Buyers of cloud services for government data should check the provider's class first.

Documents

• Official source (www.cst.gov.sa)

In this framework

• Regulatory Bylaws of the Cloud Computing and Informatics Special Economic Zone
• Data Centre Services Regulations
• Cloud Computing Services Provisioning Regulations (version 4)
• CST Guide for Cloud Computing Service Providers (version 5)
• Registration Guide in the Qualifying Category (version 2)

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21