Other Policies and Strategies

A government policy that is referred to as the Cloud First Policy”(CFP) of Saudi Arabia is a policy that covers governmental entities which are introduced to accelerate the adoption of cloud computing services by directing these entities to consider cloud options when making new IT investment decisions. The private sector is encouraged to follow the same exercise by having an internal CFP. This policy was defined in line with the key pillars of KSA’s ambitious Vision 2030. The policy hence caters to the National Information Center’s (NIC) Strategy – the entity that will serve as the primary Cloud Service Provider (CSP) for Government related data. The Kingdom of Saudi Arabia is one of the leading countries in the ICT sector in a wide region of the world, including the Middle East and North Africa (MENA) region. It is well positioned to make the most of this cloud computing opportunity by becoming one of the best-integrated infrastructure services and technically advanced in the cloud computing industry and the ICT industry in general. This document complements the cloud computing regulations issued or to be issued by other governmental entities.

In its inherent definition, a Cloud-First Policy is meant to define and typically stimulate public sector migration from traditional IT solutions to cloud-based models. Major reasons for adopting such a policy are to enhance Efficiency in different ways, such as to use of cloud computing for resource pooling and sharing across different applications and entities, leading to increased utilization of the assets. It is widely noticed that migration of infrastructure to the cloud typically results in ~30% savings in terms of the total cost of ownership. Additionally, cloud computing serves as a catalyst that can accelerate the implementation of Data Center Consolidation initiatives.

Cloud computing provides a more interoperable and portable environment for data and systems that would help achieve seamless communication between different entities. Another importance of using this policy is that it provides more robust cyber security: Beyond achieving a more efficient, innovative, and agile environment, cloud computing helps to improve overall cyber security. The government realizes that employees of cloud computing platforms in the government and commercial government be qualified Saudis and that the hosting is in the Kingdom without the ability to access it remotely from outside the Kingdom. The Cloud First Policy of Saudi Arabia is adopted due to the extensive benefits of cloud computing. This policy is intended to accelerate the pace at which Governmental entities are migrating from traditional IT solutions to cloud solutions, which will serve as a key pillar in supporting and driving the digital transformation in KSA. Entities covered by the scope of this policy are required to consider cloud computing options when making new IT investment decisions, with the goal of achieving the following:

• Increase the quality of service by using more agile, innovative solutions in the Government services sector (e-services).
• Reduce total cost of ownership by improving IT utilization, aggregating demand, and removing duplications in Governmental IT spending.
• Improve cyber security robustness by using accredited platforms with best-in-class cyber security standards and leveraging Cloud service providers’ expertise in this domain.
• Enable interoperability with other entities.

This policy is applicable to all governmental entities with the exception of the Saudi Arabian Monetary Authority and other entities primarily responsible for national security and defense, such as the Ministry of Defense (MoD), Presidency of State Security (PSS), Ministry of Interior (MoI) and National Cybersecurity Authority (NCA).