Links to official Saudi websites end with gov.sa
All links to official websites of government agencies in the Kingdom of Saudi Arabia end with .gov.sa
Government websites use the HTTPS protocol for encryption and security.
Secure websites in the Kingdom of Saudi Arabia use the HTTPS protocol for encryption.
Registered with the Digital Government Authority under number :
20250519510
Decision Overview
First: Approval of "Regulatory Framework for Cyber Security for service providers in the Telecommunication, Information Technology" document with attached formulation.
Second: The document "Regulatory Framework for Cyber Security for service providers in the Telecommunication, Information Technology“ shall enter into force as of 16/10/1442H.
Third: All service providers, as of the date of this decision, must adhere by the following:
1- Fill out the form “Determine Service Provider Level to Specify Required Level of Compliance” available on CST website, and provide it to CST within (5) working days from this date via E-mail (CRF@citc.gov.sa).
2- CST sends compliance targets to service provider that he must comply with, which includes required commitment level, within (15) working days of receiving “Determine Service Provider Category to Specify Required Level of Compliance” form, based on form results or CST decision.
3- Fill out the “Self-Assessment Form to Measure Current Reality of Cyber Security Maturity Level of Service Provider”, and submit it to CST within (3) months from the date of this decision.
4- Submit to CST periodically - as decided by CST- service provider’s completion reports for achieving the specified compliance objectives.
Fourth: Service providers classified as sensitive national infrastructure are excluded from Clause(Third), according to what they receive from CST in this regard within (5) days from the date of this decision.
