# Cloud Security in Saudi Arabia: Shared Responsibility, Data Residency and NCA Controls By CYBRT Advisory Team 8 July 2026 4 min read On this page 1. Shared responsibility, in plain terms 2. Data residency and national requirements 3. The controls to put in place first 4. Migrating securely Moving to the cloud does not hand your security to the provider. It changes which parts you are responsible for, and most cloud incidents happen in the parts that stay with you. Cloud adoption in the Kingdom has accelerated, helped by major providers opening or announcing in-Kingdom regions and by national policy encouraging cloud use across government and the private sector. The security conversations we have with clients have changed with it. The question is no longer whether the cloud is safe. It is whether your organisation is using it safely. ## Shared responsibility, in plain terms Every cloud provider publishes a shared responsibility model. The provider secures the underlying infrastructure: data centres, hardware and the core platform. You secure what you build and configure on top of it. Where the line falls depends on the service. - **Infrastructure as a service:** you are responsible for the operating systems, network configuration, applications, identities and data. - **Platform as a service:** the provider manages more of the stack, but you still own application security, identities, access configuration and data. - **Software as a service:** the provider runs the application, and you remain responsible for who has access, how it is configured and what data you put in it. Across all three, identity, configuration and data stay with you. That is why misconfiguration, such as a storage bucket left public or an administrator account without multi-factor authentication, is behind so many cloud breaches. ## Data residency and national requirements For many organisations in Saudi Arabia, where data is stored is a compliance question, not just a preference. - The **NCA Cloud Cybersecurity Controls (CCC)** set requirements for cloud service providers and for organisations that use cloud services within the NCA's scope, building on the Essential Cybersecurity Controls. - Government and regulated workloads, and data classified as sensitive under national data classification rules, are often required to stay inside the Kingdom. - The **Personal Data Protection Law** restricts transfers of personal data outside the Kingdom to defined circumstances. - Sector regulators, including SAMA for financial institutions, have their own expectations on outsourcing and cloud. Before choosing a service or region, classify the data the workload will hold and confirm which of these apply. It is far easier to choose an in-Kingdom region at the start than to migrate later. ## The controls to put in place first ### 1. Identity - Enforce multi-factor authentication for every human user, with phishing-resistant methods for administrators. - Lock away the root or global administrator credentials and use them only in emergencies. - Connect cloud consoles to your central identity provider with single sign-on, so leavers lose access everywhere at once. - Grant least privilege, and review permissions regularly. Cloud permissions accumulate quickly. - Manage machine identities and access keys carefully. Prefer short-lived credentials over long-lived keys. ### 2. Logging - Turn on audit logging for every account and subscription, including control plane activity, and send it to a central location your administrators cannot alter. - Monitor for high-risk events such as new administrator accounts, disabled logging, public exposure of storage and unusual access from new locations. ### 3. Configuration and posture - Define secure baselines using a recognised benchmark, and deploy infrastructure as code so configurations are reviewed before they go live. - Use cloud security posture management to detect misconfigurations continuously across accounts. - Block public access to storage by default and require an exception for anything that genuinely needs it. ### 4. Data protection - Encrypt data at rest and in transit. For sensitive workloads, consider customer-managed keys so you control key lifecycle and access. - Use private endpoints for databases and storage so they are not reachable from the internet. - Back up critical data to separate accounts with restricted access, and test restores. Ransomware groups now target cloud backups deliberately. ### 5. Workloads and SaaS - Protect virtual machines and containers with appropriate endpoint and runtime security, and scan images before deployment. - Review SaaS configurations and third-party app permissions, especially in collaboration and email platforms. - Consider a cloud access security broker where SaaS sprawl makes visibility difficult. ### 6. Incident response Adapt your incident response plan for cloud. Make sure the team has the access and tooling to investigate cloud logs, isolate resources and preserve evidence, and know how to engage the provider's support during an incident. ## Migrating securely The safest migrations treat security as part of the design, not a review at the end. Agree a landing zone with identity, logging, network and guardrails in place before the first workload moves. Classify data before migration, and decide which workloads stay on premises or move to an in-Kingdom region. Then migrate in waves, checking posture as you go. Our cloud security team helps organisations in the Kingdom design secure landing zones, assess posture across AWS, Azure, Google, Oracle and Huawei clouds, and meet NCA and sector requirements. We use the Cloud Controls Matrix as a foundation, mapped to national controls. How CYBRT can help ## Secure Cloud Enablement Adopt and run cloud securely: migrate workloads safely and keep data private, protected and compliant. We also help cloud service providers meet standards such as STAR and FedRAMP. ## Keep reading Cloud & OT 16 Jun 2026 4 min read ### OT Security in Saudi Arabia: Where to Start with ISA/IEC 62443 and NCA OTCC Where to start with OT security in the Kingdom: asset visibility, segmentation, remote access and monitoring, using ISA/IEC 62443 and NCA OTCC. Resilience 18 Oct 2026 7 min read ### Ransomware Response Plan for Saudi Organizations: The First 72 Hours A practical ransomware response plan for Saudi organisations: what to do in the first hour, day and 72 hours, including NCA reporting and PDPL notice. Governance 30 Sept 2026 4 min read ### What Does a Virtual CISO Do? A Guide for Saudi Organisations What a virtual CISO delivers, who benefits, how it fits NCA and SAMA expectations for an in-house security lead, and what a good first 90 days looks like. ## Ready to protect your business? Book your free security consultation today. --- Canonical page: https://cybrt.sa/cloud-security-saudi-arabia/ Guide for AI agents: https://cybrt.sa/llms.txt