CST Guide for Cloud Computing Service Providers (version 5)

Type	Guideline
Code	Document-1552
Issuing authority	Communications, Space & Technology Commission (CST)
Framework	Cloud & Data Centres
Tier	Guidelines & circulars
Legal status	In force
Instrument number	CST decision 506/1445 · Communications, Space and Technology Commission
Issued	2023-10-08
In force from	2023-10-10
Version	5
Dates	Version 5, approved by CST decision 506/1445 (8 October 2023); in force 10 October 2023
Last verified	2026-10-20

CST's Guide for Cloud Computing Service Providers (version 5) is the procedural guide to registering under the Cloud Computing Services Provisioning Regulations v4. CST approved it with the Regulations by decision 506/1445 (8 October 2023); in force 10 October 2023. Official source: CST Document-1552.

Registration is required of any provider with direct or effective control over a data centre or critical cloud infrastructure hosted and used in the Kingdom.
Applications go through CST's electronic platform, in Arabic, and must list the provider's services, cloud systems and data centres, including any foreign data centre locations used for Saudi subscribers' content. CST may refuse them.
Providers register in Class A, Class B or Class C, with rising evidence: Tier II or ISO/IEC 27001 for Class A, Tier III for Class B, and further approvals for Class C.
Providers must comply with the NCA's controls.
CST decides within 15 working days. Registration lasts three years and is renewable; CST publishes the list of registered providers.
Where the Guide and the Regulations differ, the Regulations govern.

Documents

In this framework

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21