Saudi Government Data Hosting Requirements
Saudi server, Tier III+, encryption, 24/7 monitoring, security team — government entity requirements for hosting their data.
Government Data Hosting: Not Like Regular Hosting
Hosting government entity data in Saudi Arabia is subject to strict requirements fundamentally different from standard commercial hosting. These requirements are not recommendations but legal mandates enforced by multiple regulatory bodies. Any violation could mean fines up to 5 million SAR, activity suspension, and even criminal prosecution.
Regulatory Bodies and Requirements
National Cybersecurity Authority (NCA)
NCA is the primary body responsible for cybersecurity controls in the government sector. Its controls include:
Essential Cybersecurity Controls (ECC):
- 114 controls divided across 5 domains
- Mandatory for every government entity and every company handling government data
- Periodic auditing to verify compliance
Cloud Cybersecurity Controls (CCC):
- Additional requirements specific to cloud services
- Data classification before moving to the cloud
- Mandatory encryption in transit and at rest
Digital Government Authority (DGA)
DGA sets government digital transformation standards:
- Cloud-first policy: Government entities are required to adopt cloud computing
- Government data classification: 4 levels from public to top secret
- Hosting standards: Specific specifications for government cloud service providers
SDAIA
- Personal Data Protection Law (PDPL)
- Additional requirements for government personal data
- Oversight of responsible AI use in the government sector
Infrastructure Requirements
| Requirement | Specification | Reason |
|---|---|---|
| Data center location | Within the Kingdom exclusively | data protection and localization |
| Facility classification | Tier III minimum | Continuity assurance |
| Uptime | 99.982% or higher | Maximum 1.6 hours annual downtime |
| Encryption | TLS 1.3 in transit and AES-256 at rest | Data protection |
| Backup | Daily with one full year retention | Business continuity |
| Redundancy | N+1 for every critical component | Fault tolerance |
| Power | Two independent sources with generators | Service continuity |
| Network | Connectivity with multiple telecom providers | Multiple communication paths |
Security Requirements
Physical Security
- 24/7 camera surveillance with 90-day recording retention
- Biometric or smart card access control
- 24/7 security guards
- Multi-level alarm system
Electronic Security
- Multi-layer firewalls
- Intrusion Detection and Prevention System (IDS/IPS)
- 24/7 Security Operations Center (SOC)
- Periodic vulnerability scanning and annual penetration testing
Access Management
- Two-factor authentication mandatory without exception
- Principle of least privilege
- Permission review every 90 days
- Logging every access operation with 12-month log retention
Compliance and Documentation Requirements
Required Documentation
- Written and approved information security policy
- Updated business continuity plan
- Security incident response plan
- Data classification register
- Periodic audit reports
Auditing and Review
- Quarterly internal audit
- Annual external audit by an accredited body
- At least annual penetration testing
- Annual security policy review
Government Data Classification
| Level | Description | Hosting Requirements |
|---|---|---|
| Public | Data published to the public | Local hosting preferred |
| Restricted | Internal entity data | Local hosting mandatory |
| Confidential | Sensitive data | Certified local hosting with full encryption |
| Top Secret | Highly sensitive data | Dedicated and isolated infrastructure |
How to Prepare as a Service Provider
If you are a technology company building systems for government entities:
- Use a Saudi server in a certified data center from the start
- Document everything from data classification to security procedures
- Apply encryption at every level for sensitive data
- Prepare an incident response plan before you need it
- Obtain required certifications or work with a provider that holds them
CLOUD (cloud.net.sa) provides servers in certified data centers in Riyadh and Jeddah meeting Tier III standards. The infrastructure is designed to meet NCA and DGA requirements. From a cloud server starting at competitive pricing — pricing and plans per year to custom solutions for major government projects.
Get Started
Ready to move your business to Saudi cloud? View plans and pricing or contact us for a free consultation.
