Business

Hosting for Saudi Government Sector: Requirements and Standards

CLOUD|June 20, 2025|3 min read|615 views

NCA, PDPL, data sovereignty — government entities have specific requirements. We explain the standards and how to choose a compliant hosting provider.

Saudi Government Sector Hosting: Complete Requirements

Hosting systems for Saudi government entities is not simply a matter of choosing a service provider at a good price. It is a technical and institutional compliance process that begins before purchasing any server. This guide covers the complete requirements in detail.

The Legal and Regulatory Framework

National Cybersecurity Authority (NCA): The highest authority on information security for Saudi government entities. It issues the Essential Cybersecurity Controls (ECC) that obligate all government entities and critical infrastructure to comply.

Government Cloud Computing Framework (G-Cloud): Defines requirements for qualified providers offering cloud services to government entities. Providers are classified at different licensing levels.

Essential Cybersecurity Controls (ECC)

The ECC controls cover several areas that must be present in the hosting environment:

Identity and Access Management:

Multi-factor authentication (MFA) is mandatory for administrative access
Principle of Least Privilege
Complete and retained logs of all access operations

Network Security:

Next-Generation Firewall (NGFW)
Encryption of all communications (TLS 1.2 minimum, TLS 1.3 preferred)
Separation of production environment from development and test environments

Backup and Recovery:

Clear RTO (Recovery Time Objective) and RPO (Recovery Point Objective) defined in the SLA
Periodic testing of recovery operations
Backups are encrypted and stored at a geographically separate location

Audit Logs:

Comprehensive logging of all administrative operations
Log retention for no less than one year
Immutable logs (cannot be modified after creation)

Government Data Classification

The Saudi classification system for government data includes four levels:

Classification Level	Data Type	Hosting Requirement
Top Secret	National security data	Completely isolated infrastructure
Classified	Sensitive government data	Approved government cloud or on-premise
Restricted	Internal operational data	Licensed G-Cloud provider
Public	Public content	Any trusted provider

Tier III+ Data Center Requirements

Government entities typically require data centers at Tier III minimum according to the Uptime Institute classification:

Tier III: 99.982% uptime (no more than 1.6 hours annual downtime)
Hardware and path redundancy (N+1 minimum)
Concurrent Maintainability (maintenance without service interruption)
Multiple independent power sources

Government Procurement Procedures

Etimad Platform: The government electronic contracting portal. Technology service providers must be registered and qualified.

Formal Price Quotes (RFQ/RFP): Large government entities request formal price quotes rather than direct purchases.

Contracts and SLAs: Government entity contracts include strict SLA terms with defined penalties for any downtime exceeding the agreed threshold.

Documentation Required from Service Providers

Any provider wanting to serve government entities typically needs to present:

ISO 27001 certification (information security)
Information security policy document
Recent Penetration Test reports
Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP)
Security incident record and handling procedures

Cloud Positioning

cloud.net.sa hosts its infrastructure in Saudi data centers in Riyadh and Jeddah. For government sector and critical enterprise clients, cloud.net.sa provides VPS servers with customizable resource levels and clear contractual SLAs — complete transparency on every contract requirement rather than "contact us for pricing."