Saudi Arabia
CST CRF: what it requires and how to self-assess
CST Cybersecurity Regulatory Framework (CRF), Saudi Arabia — Decision 424/1442 (2020)
Direct support
Talk to a CST CRF specialist
Reply within one business day.
Short answer
The CST Cybersecurity Regulatory Framework (CRF) is the cybersecurity framework for Saudi Arabia’s ICT sector, issued by the Communications, Space and Technology Commission (CST, formerly CITC) by Decision 424/1442 in 2020. It sets out the cybersecurity obligations service providers licensed or registered by CST must meet, and compliance is assessed by CST.
Why it matters
What CST CRF readiness does for the business.
Your licence carries it
The CRF sets what CST expects of licensed and registered ICT providers. It is narrower than a national framework and more specific, so a general security programme can miss obligations the licence names.
Assessed by the regulator
CST assesses compliance. Evidence has to exist before the assessment, traced to the requirement, rather than be assembled while the assessor waits.
It sits alongside NCA ECC
Most providers carry both. One control set mapped to the CRF and the ECC means the same evidence answers each framework.
Scope
Who it applies to
- Service providers licensed or registered by CST.
- Telecom operators and ICT service providers under CST jurisdiction.
- Postal service providers within CST’s remit.
- Organisations that also hold NCA ECC obligations, which sit alongside the sectoral framework.
- Security and compliance teams responsible for CST submissions and follow-up.
Controls
Key requirements
- Maintain cybersecurity governance with named responsibility at management level.
- Identify and classify the assets, services and data in scope.
- Manage cyber risk: identify, assess, treat and track it with owners and dates.
- Apply technical controls across access, networks, systems and endpoints, proportionate to the service.
- Detect and respond to incidents, with defined escalation and reporting routes to CST where required.
- Keep business continuity and recovery arrangements, including for service interruption.
- Vet third parties and suppliers, and record the cybersecurity terms they must meet.
- Keep evidence that the framework is operated, so compliance can be demonstrated when CST assesses it.
The programme
How we take you through CST CRF.
Platform and people on the same path: Fortress holds the controls and the evidence, our team runs the assessment with you, and nothing is rebuilt when the auditor arrives.
- 01
Scope the licence and services
We start from the services the CST licence covers, then agree the assets, systems and data that support them.
- 02
Map the framework to controls
Each CRF obligation is mapped to a control you already run or need to add, with a named owner for it.
- 03
Close the gaps
Gaps are turned into tasks with owners and dates, prioritised by what the regulator assesses and what the exposure costs.
- 04
Assemble the evidence set
Policies, registers, test results and incident records are collected against the mapped controls in Fortress.
- 05
Set incident and continuity routes
Escalation, regulator reporting and recovery arrangements are written and exercised, not left in a template.
- 06
Review before assessment
An internal review runs against the CRF ahead of any CST assessment, with findings closed and the position recorded.
Before / after
Where teams start, and where CST CRF readiness leaves them.
Before · status quo
What the organisation looks like today.
- 01
The licence condition is known, but nobody can trace it to a control.
- 02
Evidence is scattered across teams and assembled after the request arrives.
- 03
CRF and NCA ECC obligations are managed as two separate programmes.
- 04
Incident routes exist on paper and have never been exercised.
After · with Risknox
What changes once the programme is running.
- 01
Every CRF obligation carries a control, an owner and evidence.
- 02
The evidence set is maintained continuously in Fortress.
- 03
One control set answers the CRF and the NCA ECC at once.
- 04
Escalation and reporting routes are exercised and recorded.
Self-assess it in Fortress
Three steps from “where do we stand” to a plan.
- 1
Pick CST CRF
Choose it in the GRC builder. Your first framework is included, and shared controls are reused if you add another.
- 2
Answer and attach evidence
Work through the control set, assign an owner to each control and attach the evidence behind the answer.
- 3
Get the gap report
See what is missing, with severity, a named owner and a remediation plan you track to closure.
Product screenshot
Self-assessment and audit readiness. Formal certification or attestation is done by an accredited auditor.
Readiness check
Two questions, and an indicative band for CST CRF.
No login. Nothing is stored until you ask for the plan.
Team size
Where are you today?
Pick a team size and where you are today to see the band.
Questions we get asked
Who has to comply with the CST CRF?+
Service providers licensed or registered by CST — mainly telecom, ICT and postal providers. If your licence conditions reference the framework, it applies to you. Confirm the position for your specific licence with CST or counsel.
How is CST CRF compliance assessed?+
By CST. The Commission assesses whether a provider meets the framework, and providers are expected to hold evidence that the obligations are operated, not merely described in policy.
Does the CST CRF replace NCA ECC?+
No. NCA ECC applies nationally and the CST CRF sets the sectoral requirements for the ICT sector. Providers typically map the two into one control set and evidence it once.
Is the CST CRF the same as ISO 27001?+
No. ISO 27001 is a certifiable information security management system; the CST CRF is a regulator’s framework, assessed by the regulator. Providers usually run ISO 27001 and map the CRF obligations onto the same controls.
Self-assessment and audit readiness, in one place.
The control set, the evidence and the gap report — no rebuild when the auditor arrives.
General information, not legal advice.
Last updated November 2026