CST-Licensed or Registered Service Providers
Organizations operating under CST licensing or registration should confirm the CRF requirements and compliance target applicable to their services.
CST CYBERSECURITY REGULATORY FRAMEWORK
CST CRF Compliance Services Saudi Arabia
SecureLink supports organizations subject to the Communications, Space & Technology Commission's Cybersecurity Regulatory Framework with scope review, gap assessment, control mapping, remediation planning and readiness support. We first confirm the applicable CST requirements and compliance target, then connect them to governance, technical safeguards, operating practices and evidence.
CST CRF Overview
Understanding CST CRF in Saudi Arabia
CST's Cybersecurity Regulatory Framework is designed for service providers in the Information and Communications Technology sector. CST states that the framework mainly concerns organizations licensed or registered by CST and entities otherwise subject to CST as the regulator of the sector.
The compliance programme should start with the organization's regulatory status, service scope and applicable CST requirements. From there, the focus is on governance, control implementation, evidence and the practical management of cybersecurity risk.
Where other Saudi requirements also apply, those obligations should be mapped separately. CST CRF should not be treated as a replacement for NCA ECC, PDPL or another framework that independently governs the organization. Where multiple requirements apply, each should be assessed against its own scope.
View CST's official CRF publication →Framework at a glance
CST CRF Compliance Structure
The published CRF uses progressive compliance levels and six core control domains. The applicable target should always be confirmed against the current CST publication and the requirements communicated to the service provider.
3Control requirement levels: CL1, CL2 and CL3
6Core control domains
CSTIssuing and sector-regulatory authority
ICTPrimary sector context of the CRF
Scope & applicability
Who Should Assess CST CRF Requirements?
CST applicability depends on the organization's relationship with CST, the services it provides and the regulatory requirements that govern its environment. Scope should be confirmed before the assessment starts.
Telecom & Connectivity Providers
Telecommunications and connectivity services may require structured cybersecurity governance and control implementation under the applicable CST regulatory scope.
Hosting, Cloud & Digital Service Providers
Hosting, infrastructure and other digital services should assess CST requirements where their regulatory status and service model bring them within scope.
Important: Service type alone does not establish the full compliance obligation. Confirm current CST scope, the applicable compliance target and any additional regulatory or contractual requirements before mapping controls.
CNI & non-CNI structure
How the CST CRF Applies to Service Providers
The framework distinguishes service providers classified as Critical National Infrastructure from service providers that are not classified as CNI. The applicable route should be confirmed from the current CST and NCA position before the assessment boundary is finalized.
CNI service providers
Additional CST and NCA Requirements
CNI service providers must comply with the NCA Essential Cybersecurity Controls as specified by the CRF and follow the additional CST requirements applicable to CNI service providers.
- Coordinate the applicable ECC compliance position with CST.
- Provide CST with compliance information required under the framework.
- Share applicable critical cybersecurity risks, alerts and incident information through the required channels.
- Be prepared for CST compliance monitoring and review activities.
Non-CNI service providers
Six Core Requirement Areas
The CRF specifies six main requirement areas for service providers not classified as CNI. These form the core of the non-CNI compliance assessment.
- Governance
- Asset Management
- Cybersecurity Risk Management
- Logical Security
- Physical Security
- Third-Party Security
Important: CST can determine or communicate the applicable scope and compliance requirements. The framework also states that CST may monitor compliance through mechanisms including self-assessment, field inspections, workshops and proactive or incident-triggered audits.
Compliance levels
CST CRF CL1, CL2 & CL3
The CRF uses progressive compliance levels. The level and detailed target requirements should be verified with CST rather than assumed from industry alone.
CL1
Control Requirements Marked CL1
Baseline control requirements identified as CL1 in the applicable CRF control set and compliance scope.
CL2
Control Requirements Marked CL2
Additional requirements identified as CL2 in the applicable CRF control set; applicability must be confirmed for the service provider.
CL3
Control Requirements Marked CL3
Requirements identified as CL3 in the applicable CRF control set, with the final target determined by CST scope and compliance requirements.
Level reminder: Compliance levels are not a substitute for the official CST scope decision or current target requirements. SecureLink can help document the basis for the applicable assessment scope before remediation begins.
Control structure
Six CST CRF Requirements for Non-CNI Service Providers
For service providers not classified as Critical National Infrastructure, the CRF sets out six requirement areas: Governance, Asset Management, Cybersecurity Risk Management, Logical Security, Physical Security and Third-Party Security. Detailed control wording and applicability should always be checked against the current CST framework.
01
Cybersecurity Governance
Strategy, policies, roles, responsibilities, oversight and management processes that establish accountability for cybersecurity.
02
Asset Management
Identification, ownership and management of relevant information and technology assets within the applicable service scope.
03
Cybersecurity Risk Management
Identification, assessment, treatment and monitoring of cybersecurity risks affecting ICT services and supporting environments.
04
Logical Security
Access management, system and network safeguards, authentication, configuration, monitoring and other logical security controls as applicable.
05
Physical Security
Protection of facilities, equipment and physical environments supporting ICT services and technology operations.
06
Third-Party Security
Governance and oversight of suppliers, outsourced services, service dependencies and other third parties that may affect the security of the environment.
CST CRF compliance services
Our CST CRF Compliance Services
SecureLink supports the compliance programme from initial scope review through assessment, remediation, evidence readiness and ongoing review.
01
CST CRF Scope & Applicability Review
Confirm the organization’s CST status, service scope, applicable CRF requirements and related regulatory or contractual obligations before detailed assessment work.
02
CST CRF Gap Assessment
Assess current governance, controls, processes and evidence against the applicable CRF requirements and identify documented gaps.
03
Control & Evidence Mapping
Map requirements to control owners, policies, procedures, technical safeguards and supporting evidence so readiness can be demonstrated clearly.
04
Governance & Policy Support
Review or strengthen cybersecurity governance structures, policies, procedures, roles and reporting mechanisms relevant to the CRF scope.
05
Remediation & Implementation Support
Translate assessment findings into prioritized actions and support practical remediation and control implementation based on the agreed scope.
06
Readiness, Reporting & Review Support
Organize evidence, management reporting and readiness activities for applicable CST review, self-assessment or audit requirements.
Programme outcomes
What a Strong CST CRF Programme Should Establish
The goal is not only to document requirements, but to connect them to accountable owners, operating practices, evidence and remediation.
Clear Scope Decisions
Know which CST CRF requirements apply before resources are committed to assessment or remediation.
Defined Control Ownership
Connect requirements to accountable owners, policies, processes and evidence.
Evidence Readiness
Keep records and technical evidence traceable to the requirements they support.
Prioritized Remediation
Turn findings into practical actions, ownership, dependencies and target dates.
Better Management Visibility
Provide a clearer view of open gaps, risks, progress and readiness.
Maintainable Compliance
Build repeatable governance and review practices rather than relying on a one-time documentation exercise.
Delivery approach
Our CST CRF Compliance Process
A defined sequence helps the organization move from scope uncertainty to an evidence-backed remediation and readiness programme.
01
Scope & Applicability
Confirm CST regulatory status, service scope, applicable CRF requirements and related obligations.
02
Current-State Assessment
Review governance, policies, controls, operational practices and supporting evidence.
03
Gap & Risk Analysis
Identify control gaps, evidence weaknesses, ownership issues and risk priorities.
04
Remediation & Readiness
Build a practical roadmap, support remediation and organize evidence for the applicable review requirements.
05
Ongoing Assurance
Track actions, refresh evidence and support recurring compliance and management reporting.
Common readiness gaps
Where CST CRF Programmes Often Need Attention
Readiness problems often come from unclear scope, fragmented evidence and a gap between written policies and day-to-day control operation.
Unclear CRF scope
Teams may start with controls before confirming the exact CST service-provider scope and applicable requirements.
Control ownership gaps
Requirements are known, but the responsible owners and evidence expectations are not clearly assigned.
Policy-to-practice gaps
Policies may exist without enough operational records to demonstrate how controls work in practice.
Third-party dependencies
Cloud, hosting, suppliers and outsourced services can introduce evidence and accountability gaps.
Evidence fragmentation
Relevant records, approvals, logs and reports are spread across teams and systems.
Recurring readiness pressure
Organizations struggle to maintain evidence, track remediation and stay prepared after the initial assessment.
Official resources
CST CRF Reference Sources
Regulatory requirements can change. Use CST's current publications and official guidance as the authoritative reference for the actual compliance engagement.
Official CST publication
Cybersecurity Regulatory Framework (CRF)
CST's official CRF publication for service providers in the Information and Communications Technology sector.
Open CST CRF publication →CST cybersecurity guidance
Cybersecurity in the ICT Sector
CST's cybersecurity information page includes the Commission's regulatory context and official contact channels for CRF-related enquiries.
View CST cybersecurity guidance →Why SecureLink
A Practical, Evidence-Led CST CRF Approach
SecureLink connects the applicable CST requirements to actual ownership, technical and operational controls, evidence and remediation actions.
Framework-Specific Scoping
We start with the applicable CST requirements instead of applying a generic cybersecurity checklist.
Evidence-Led Delivery
Findings are connected to owners, records, technical evidence and practical next actions.
Saudi Regulatory Context
We consider CST requirements together with other Saudi obligations that may affect the same environment.
Practical Remediation
The output is designed to help teams close real control and evidence gaps, not only produce documentation.
Cross-Framework Coordination
Where NCA or other requirements also apply, overlapping areas can be coordinated without treating separate frameworks as interchangeable.
Ongoing Readiness
We support repeatable review, evidence maintenance and remediation tracking after the initial assessment.
Start with the right scope
Prepare for CST CRF Compliance
Whether you need to confirm applicability, assess your current controls, organize evidence or build a remediation roadmap, SecureLink can help define a practical CST CRF engagement around your actual services and regulatory requirements.
CST CRF FAQ
Frequently Asked Questions
Clear answers to common questions about CST CRF scope, compliance levels, assessment, evidence and related requirements.
Need help defining your CST CRF scope?
Start with your CST regulatory status, services, applicable compliance target, current controls and available evidence. A defined scope makes the assessment more focused and defensible.
What is the CST Cybersecurity Regulatory Framework (CRF)?
The CST Cybersecurity Regulatory Framework (CRF) is a cybersecurity regulatory framework for service providers in the Information and Communications Technology sector. CST states that it mainly concerns organizations that are licensed or registered by CST and organizations otherwise subject to CST as the sector regulator.
Who needs to assess CST CRF compliance in Saudi Arabia?
Organizations that are licensed or registered by CST, or otherwise fall within CST regulatory scope, should confirm the CRF requirements that apply to their service. The exact compliance target should be established from the current CST framework, the organization’s regulatory status and any instructions or requirements communicated by CST.
What are CL1, CL2 and CL3 in CST CRF?
The CRF labels individual control requirements by compliance level: CL1, CL2 and CL3. The applicable requirements depend on the organization’s CST scope and the compliance target communicated by CST; organizations should not self-select a level without confirming the applicable requirements.
How does a CST CRF compliance assessment work?
A compliance assessment reviews the applicable CRF requirements against the organization’s governance, policies, processes, technical safeguards and evidence. It identifies control weaknesses, ownership needs, priorities and remediation actions.
What services does SecureLink provide for CST CRF compliance?
SecureLink provides scope and applicability review, gap assessment, control and evidence mapping, governance and policy support, remediation planning, implementation support, readiness documentation and ongoing compliance support based on the engagement scope.
Is CST CRF the same as NCA ECC?
No. CST CRF is a sector-specific framework issued by CST for applicable ICT service providers, while NCA ECC is a separate national cybersecurity control framework with its own scope. Organizations subject to both should assess each applicable requirement set and coordinate overlapping controls and evidence without assuming that one replaces the other.
Does CST CRF compliance mean that a company receives a certification?
Organizations should not assume that CST CRF is a generic third-party certification scheme. Compliance activities, assessments, reporting and any review requirements should follow the current CST framework and the obligations applicable to the service provider.
How long does a CST CRF compliance programme take?
There is no single timeline. Duration depends on the applicable compliance level and scope, current control maturity, number and severity of gaps, evidence availability, technical remediation and stakeholder readiness.