THE CLOUD IMPERATIVE DIGITAL SUSTAINABILITY FRAMEWORK: Experiences from KSA’s Strategy Digital Practices andTransformation Government from the Kingdom of Saudi Arabia A joint research article/white paper with the World Bank Digital Development Team THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 1 © 2024 The World Bank 1818 H Street NW, Washington DC 20433 Telephone: 202-473-1000; Internet: www.worldbank.org Some rights reserved. This work was prepared by The World Bank at the request of the Digital Government Authority (DGA) of Saudi Arabia. The findings, interpretations, and conclusions expressed in this work do not necessarily reflect the views of the Executive Directors of The World Bank or the governments they represent. The World Bank does not guarantee the accuracy of the data included in this work and does not assume responsibility for any errors, omissions, or discrepancies in the information, or liability with respect to the use of or failure to use the information, methods, processes, or conclusions set forth. The boundaries, colors, denominations, links/footnotes and other information shown in this work do not imply any judgment on the part of The World Bank concerning the legal status of any territory or the endorsement or acceptance of such boundaries. The citation of works authored by others does not mean the World Bank endorses the views expressed by those authors or the content of their works. Nothing herein shall constitute or be construed or considered to be a limitation upon or waiver of the privileges and immunities of The World Bank, all of which are specifically reserved. RIGHTS AND PERMISSIONS The material in this work is subject to copyright. Because The World Bank encourages dissemination of its knowledge, this work may be reproduced, in whole or in part, for noncommercial purposes as long as full attribution to this work is given. World Bank. 2024. © World Bank. All queries on rights and licenses, including subsidiary rights, should be addressed to World Bank Publications, The World Bank, 1818 H Street NW, Washington, DC 20433, USA; fax: 202-522- 2625; e-mail: pubrights@worldbank.org. Cover photo: © Shutterstock.com Sample credit for a non-WB image: © Ami Vitale / Panos Pictures. Used with the permission of Ami Vitale / Panos Pictures. Further permission required for reuse. Sample credit for a WB image: © Curt Carnemark / World Bank. Further permission required for reuse. Cover design: Adelaroche Designs 2 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA THE CLOUD IMPERATIVE Strategy and Practices from the Kingdom of Saudi Arabia THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 3 1 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA TABLE OF CONTENTS Foreword.......................................................................................................................................................................................3 Acknowledgements And Disclaimer....................................................................................................................................4 Abbreviations..............................................................................................................................................................................5 Executive Summary...................................................................................................................................................................6 1. Introduction: The Cloud Imperative for Developing Countries........................................................8 2. The Cloud Imperative: Why Governments Need to Move Their Systems Into the Cloud.........10 2.1 Cloud First Policies.............................................................................................................................................................11 2.2 Cloud Deployment and Service Models for Public Services...............................................................................12 2.3 Cloud Deployment Models in Regulated Environments.......................................................................................13 2.4 Cloud Service Models in Regulated Environments...............................................................................................14 3. Saudi Arabia’s Strategy and Practices to Accelerate Cloud Adoption in the Public System....16 3.1 Vision and Strategy............................................................................................................................................................17 3.2 Legislation, Regulations, Policies, and Guidelines................................................................................................ 20 3.3 Institutional Arrangements........................................................................................................................................... 28 3.4 Working with Industry: CSPS and Local Companies..............................................................................................31 4. Takeaways and Challenges Ahead..........................................................................................................35 4.1 Key Takeaways.....................................................................................................................................................................35 4.1.1 Establish a National Aspiration and Strategy....................................................................................................... 36 4.1.2 Ensure Timely Implementation of Legislative and Policy Measures............................................................ 36 4.1.3 Foster Collaboration Across Institutions............................................................................................................... 36 4.1.4 Empower the Public Sector to Proactively Leads Cloud Migration...............................................................37 4.1.5 Enable Cloud Adoption by Partnering with Industry and Providing Support to Companies............... 38 4.1.6 Boost User Trust to Spur the Cloud Market.......................................................................................................... 38 4.2 Navigating the Challenges Ahead.................................................................................................................................39 4.2.1 Closing the Digital Skills Gap......................................................................................................................................39 4.2.2 Addressing Data Localization Requirements....................................................................................................... 40 4.2.3 Addressing the Energy Efficiency of Data Centres............................................................................................. 40 4.2.4 Establishing Centralized Procurement...................................................................................................................42 5. Conclusion......................................................................................................................................................43 References................................................................................................................................................................................. 45 Appendix A: Cloud Readiness Tools.................................................................................................................................. 46 Appendix B: DGA Organizational Chart..............................................................................................................................47 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 2 The digital transformation in the Kingdom of Saudi FOREWORD Arabia (KSA) has put the country at the forefront of innovation, enabling the government to reimagine public service delivery and public administration. Digital is transforming Saudi Arabia, with a gamut of daily life transactions now managed online, from the registration of a newborn or a new vehicle to obtaining a travel visa. The same is true for the private sector and businesses, as employee registration, work permits, insurance, and the applications for or renewals of professional licenses can also all be handled online. As the digitalization of public services matures, so does the capacity of Digital Government Authority (DGA) regulator to orchestrate the transformation on the basis of a safe and robust legal and regulatory framework, simplified and design- based thinking for creation of people-centered services, and technology solutions such as cloud computing that enable a scalable, efficient deployment of online services. This white paper narrates the ongoing migration of digital government services to the cloud, as led by several main actors in the digital ecosystem of the Kingdom, particularly the DGA’s own Government Cloud Office (GCO). It has been jointly researched and co-created by DGA researchers, in partnership with the World Bank Digital Development Global Practice. It reflects the beginning of the journey to implement the national “Cloud First” policy established in the Kingdom in 2023. I hope the narration of our ongoing migration to cloud computing, the analysis of the steps taken, and the evidence of early results can support policy makers, researchers, project managers, and technology practitioners who seek to acquire practical insight on this complex journey. Thank you, ENG. AHMED ALSUWAIYAN Governor, Digital Government Authority Kingdom of Saudi Arabia 3 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA ACKNOWLEDGEMENTS AND DISCLAIMER This World Bank white paper was jointly authored by Asia (ECA) and the Middle East and North Africa regions two teams, respectively from the Saudi Government, (MNA) in the Digital Development Global Practice. and the World Bank, under a Technical Assistance partnership with the Saudi Digital Government The white paper was produced in collaboration with Authority (DGA). The Saudi Team was led by Dr. Khaled the Digital Government Authority of the Kingdom of Alhazmi, under the leadership of Dr. Abdullah Al Faifi, Saudi Arabia under the funding of the World Bank’s Vice Governor of the DGA, and under H.E. the DGA Reimbursable Advisory Services. The DGA and the Governor, Eng. Ahmed Al Suwaiyyan. The World Bank World Bank’s cooperation in issuing this disclaimer co-authors were Samia Melhem (Task Team Leader), demonstrates their commitment to promote safe and Serene Ho (Senior Digital Development Specialist), efficient cloud computing practices in KSA. This is Andrea Carugati (Senior Consultant), and Albatool particularly important given the growing demand for Abdulrahman M. Abu Hashem (Digital Development cloud computing services in the country, with many Consultant). The authors are also grateful to Seda organizations looking to leverage these services to Pahlavooni, Marta Priftis and Dina Richani (Digital accelerate their digital transformation journey. This Development Consultants) for data & research. The document is a product of the staff of the DGA and white paper was edited by Erin Rupprecht Aylor and The World Bank with contributions from external the graphic designer was Andres de la Roche. sources. Any findings, interpretations, and conclusions expressed in this work do not necessarily reflect The authors would like to express gratitude for peer the views of The World Bank, its Board of Executive review comments received from across the World Directors, or the governments they represent. The Bank Group for refining the message of the white material contained in this document is intended for paper, including from Stela Mocan (Manager), Khuram general information purposes only and does not Farooq (Senior Financial Management Specialist), constitute legal advice in any regard. Such material and Vlad Manoil (Digitl Development Specialist) of is intended to be neither exhaustive nor prescriptive the World Bank as well as from Professor Lapo Mola and should in no circumstances be construed as or (PhD), Associate Professor, Skema Business School, substituted for appropriate professional financial, and University of Verona. technical or legal advice on Cloud Computing projects or programs. Unless otherwise noted, “$” denotes US The white paper benefited from the overall guidance of Dollars throughout this white paper. Michel Rogy, Practice Manager for Europe and Central THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 4 ABBREVIATIONS AI: Artificial Intelligence MENA: Middle East and North Africa AWS: Amazon Web Services MIS: Al Moammar Information Systems CAPEX: Capital Expenditure NCA: National Cybersecurity Authority CART: Cloud Adoption Readiness Tool NCDT: National Committee for Digital Transformation CCRF: Cloud Computing Services Provisioning NDU: National Digital Transformation Unit Regulations NIC: National Information Center CSP: Cloud Service Provider NIST: National Institute of Standards and Technology CST: Communications, Space & Technology Commission NSDAI: National Strategy for Data & AI DGA: Digital Government Authority OPEX: Operating Expense EGDI: Electronic Government Development Index PaaS: Platform as a Service FTZ: Free Trade Zone PDPL: Personal Data Protection Law GCO: Government Cloud Office PDI: Public Digital Infrastructure GDP: Gross Domestic Product PII: Personally Identifiable Information GDPR: General Data Protection Regulation SaaS: Software as a Service GHG: Greenhouse Gas SDAIA: Saudi Data & AI Authority IaaS: Infrastructure as a Service SDG: Sustainable Development Goal ICT: Information and Communications Technology SEZ: Special Economic Zone IEA: International Energy Agency SME: Small and Medium-sized Enterprise IoT: Internet of Things TII: Technology Infrastructure Index IT: Information Technology UN: United Nations KSA: Kingdom of Saudi Arabia US: United States MCIT: Ministry of Communications and Information Technology VC: Venture Capital 5 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA EXECUTIVE SUMMARY This white paper presents the best practices adopted in the Kingdom of Saudi Arabia (KSA) in developing its cloud computing infrastructure and deploying cloud services across the public sector. It is intended to serve as a case study for governments of developing countries as they map out their own transitions from on-premises to cloud infrastructure. The Kingdom of Saudi Arabia (KSA) has invested significantly in cloud computing for its public sector digitalization journey, led by a powerful vision for digital government that encompasses strategy, policies, governance, programs and best practices. The experience of KSA can serve as inspiration for similar moves for other governments. The white paper’s target audience includes government cloud ecosystem and the dynamics that govern it; (ii) decision-makers focused on leveraging cloud-based a clear top-down approach that creates clarity both on infrastructures for digital development, alongside the legal and regulatory aspects; and (iii) an actionable business leaders, industry analysts and policymakers, implementation plan for all public agencies. The particularly in developing countries. cloud ecosystem requires an understanding of the stakeholders, their interests, and their dynamic Cloud computing has emerged as a technological relations. The top-down governance approach starts game changer, offering governments an opportunity with the vision, followed by the strategy, legislation, to leapfrog legacy IT models and accelerate digital regulations, policies, and guidelines, to finally reach transformation. The KSA experience highlights how the execution layer. governments can roll out citizen-centered services more quickly, and more cost-effectively, by leveraging Key takeaways from the KSA experiences highlighted the cloud’s on-demand access for scalable and in this white paper include the importance of: reusable computing resources. This is particularly z A well-defined national strategy important for developing countries since, thanks z The timely implementation of legislative and to cloud solutions, these goals can be achieved policy measures while bypassing the traditional challenges faced by developing countries, such as access to capital, talent, z The prioritization of securing safe and reliable infrastructure, and technology. cloud providers (inspired by the systematic techniques Saudi Arabia has adopted to attract This white paper highlights practices adopted by the hyper-scalers) KSA Government to lead the digital transformation z The public sector taking the lead on cloud in the country, with the end goal of migrating the migration entire government Information Technology (IT) z Partnering with leading cloud service providers infrastructure and services to the cloud by 2030. These practices are: (i) a deep understanding of the z Providing support to companies to adopt the cloud THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 6 EXECUTIVE SUMMARY This white paper also discusses the challenges ahead, in the private sector interested in promoting the digital such as closing the digital skills gap, navigating development agenda and connecting to, and profiting data localization requirements, and addressing the from, the global digital economy. This paper caters energy efficiency of data centers. An important note to authorities at the central government level and at for developing countries is that overcoming these specific agencies. By presenting the experiences of the challenges can be done, with the right competencies Kingdom of Saudi Arabia as a case of best practice, the and skills, within the normal operations and budget of objective is to provide inspiration for decision makers a government. in developing countries. In conclusion, this white paper emphasizes that, if This paper is a part of a larger body of research created implemented thoughtfully, cloud solutions can be a and distributed by the World Bank Group regarding catalytic force to build 21st-century governments that the cloud agenda as a key element of public digital are more agile, data-driven, and responsive to citizens. infrastructure (PDI). Ongoing research encompasses To realize the potential of the cloud, developing country the enabling ecosystem required to facilitate cloud governments will need to adjust the KSA experiences to solutions, the economic implications of cloud migration, fit the context of their own local cloud ecosystem and the sustainability of cloud solutions and data centers, local governance. as well as the legal and regulatory considerations that play a crucial role in determining the most suitable This paper is intended for decision-makers and cloud service options. policymakers in the public sector and business leaders   7 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA INTRODUCTION: 1 THE CLOUD IMPERATIVE FOR DEVELOPING COUNTRIES As governments in developing countries strive to deliver better public services and foster economic growth in an increasingly digital world, cloud computing has emerged as a technological game changer. The global cloud services market reached $700 billion in 2024 and most businesses have integrated cloud solutions in their IT landscapes. Governments worldwide are taking note, and most Cloud computing provides an alternative to upfront governments have sophisticated cloud strategies.1 investments in IT infrastructure that risk obsolescence. However, cloud strategies are not easily portable The cloud’s pay-as-you-go model shifts costs from from country to country because location, geography, CapEx to OpEx, freeing up scarce public funds (Wahsh and other ecosystem components such as existing & Dhillon, 2015). Through the cloud, governments infrastructure for the internet and energy play a key can access cutting-edge technologies like AI and role in the deployment of cloud solutions. Thus, while big data analytics without requiring deep in-house adopting cloud technology may seem like a clear expertise. This allows them to mine the growing troves choice for cash-strapped public sectors in emerging of government data not only to provide personalized economies, the decision is far from simple. It involves services to citizens but also to improve policymaking carefully weighing the transformative benefits against (Kuyucu, 2011; Jaeger, 2008), combat corruption the unique risks and challenges of the local context. On (Goundar, 2010), optimize healthcare (Sultan, 2014), the positive side, cloud computing offers governments education (González-Martínez, 2015), art conservation in developing countries an opportunity to leapfrog (Carugati, 2005), and more. legacy IT models and accelerate digital transformation; the experiences of other countries can be of inspiration The cloud’s benefits extend beyond cost and capability. in this transition. The case of cloud computing in the Cloud can help the governments in developing Kingdom of Saudi Arabia (KSA) presents exemplary countries to overcome perennial challenges like IT practices to achieve these goals. The KSA experience skills shortages. Most developing countries struggle provides a notable example of how, with the cloud’s to attract top technology talent when competing on-demand access to scalable computing resources, the with higher private sector salaries. By outsourcing Saudi government, and others like it, can roll out citizen infrastructure management to global cloud providers, services more quickly and cost-effectively than ever governments can focus the limited human capital at before. As presented below, KSA achieved advances in their disposal on citizen-facing innovation rather than healthcare, education, and citizen services thanks to a on keeping the lights on or foundational technologies well-targeted cloud strategy. that can easily be outsourced (Lian et al., 2014). The cloud’s standardized environment also makes it easier 1 The World Bank, 2022. “Government Migration to Cloud Ecosystems: Multiple Options, Significant Benefits, Manageable Risks.” World Bank, Washington, DC. License: Creative Commons Attribution CC BY 3.0 IGO THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 8 1. INTRODUCTION: THE CLOUD IMPERATIVE FOR DEVELOPING COUNTRIES to collaborate and share data across government Despite these caveats, the benefits of cloud computing silos, enabling and facilitating a whole-of-government are too significant for developing countries to ignore. approach. Cloud distributed architecture improves As they grapple with the pressing challenges of resilience against natural disasters compared to expanding access to and improving the quality of public on-premises data centers; this capability is critical for services on tight budgets, the cloud offers a powerful countries vulnerable to climate shocks. tool to accelerate progress. While practices from leading digital countries cannot be simply “imported” without However, the cloud also poses risks that developing further consideration for the local ecosystem, practices country governments cannot ignore. Chief among them from a country that has successfully migrated public are data sovereignty and security concerns. Hosting services to the cloud can become an important source sensitive citizen data on foreign cloud platforms for inspiration. This paper discusses the practices of raises complex questions about jurisdiction, privacy cloud adoption in the Kingdom of Saudi Arabia as a safeguards, and foreign government surveillance source of inspiration for countries in the region and/ (Polyviou & Pouloudi, 2015). Following the KSA example, or with similar level of development and institutional the solution of establishing data centers in-country configuration. could be agreed to with cloud providers, but this may not be a viable solution in all emerging economies. This paper begins by presenting an overview of cloud Connectivity and reliability challenges can also limit options and requirements in regulated environments. cloud benefits for developing country governments. After that it presents the approach adopted in KSA. KSA The cloud depends on high-speed, always-on internet presents an interesting case for best practices since it access. But many emerging economies still face major is pursuing a strategy to position the country among gaps in broadband coverage, especially outside cities. the top-performing digital countries and has been Indeed, the technology infrastructure is one of the climbing the UN EGDI index in each of the index’s last components in the United Nations’ E-Government three editions, positioning itself as the leading digital Development Index (EGDI) and it is considered the country in the region. According to the International foundation of digital government. KSA has worked Monetary Fund’s (IMF) economic research group, Saudi hard to create a solid foundation for digital services, Arabia is making impressive strides in improving its notching a Technology Infrastructure Index (TII) of 0.87, business environment, attracting foreign investments, which is above the European average of 0.84 in 2022.2 and creating employment across multiple industries Until the digital divide is bridged, the cloud’s potential as part of its digital Vision 2030. The social impacts of will remain untapped for large population segments cloud-based digital services have been remarkable, around the globe (Wahsh & Dhillon, 2015). Even with making it easier to do business and provide educational, access, latency-sensitive government applications may health-related, and other integrated services to all suffer from the absence of local data centers. Power constituencies, all in a timely manner. supply instability is another concern. Even where cloud providers are starting to expand their data center footprints in developing markets, coverage remains uneven and uncertain; cloud-based digital services inherit the risks of these problems. 2 EGDI 2022 Annex: https://desapublications.un.org/sites/default/files/publications/2022-11/Annexes%2BCover.pdf 9 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA THE CLOUD IMPERATIVE: 2 WHY GOVERNMENTS NEED TO MOVE THEIR SYSTEMS INTO THE CLOUD Cloud computing has become the foundation for the digital transformation of organizations (Balakrishnan et al., 2021). Cloud computing offers access to on-demand, sophisticated, and ever-developing computing services in a variety of configurations. Since the speed of adoption is fast, relative to As can also be seen in Figure 2.1, while the use of cloud on-premises installations, cloud computing can enable computing increased in the period 2017 to 2022 for countries to develop their digital government at an most countries, the rate of change varied significantly unprecedented pace, making it an attractive solution across the globe. A similar trend is seen across for governments worldwide. Not only is the adoption of European countries where, despite higher adoption of cloud computing increasing, but so is the dependency cloud, the numbers vary greatly from country to country. on its availability. According to Gartner, between 2017 As it will be shown in the Saudi case below, the Saudi and 2022, many countries worldwide saw increases in government is facilitating the adoption of cloud both both the rate of growth in spending on public cloud across public agencies and in local companies as part services and the percentage of total IT spending on of a cloud ecosystem approach. Saudi agencies and public cloud services. Figure 2.1 below, shows these firms are increasingly adopting the cloud to access data for a group of exemplary countries. China, India, technologies such as AI to perform computationally and Indonesia lead the charge with the greatest growth intensive processes using complex data and to take in spending on public cloud services (more than 20%), analysis-driven decisions. This is part of an effort while Argentina and Turkey lag (among the countries to motivate adoption across the public and private in the study). ecosystem. THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 10 2. THE CLOUD IMPERATIVE: WHY GOVERNMENTS NEED TO MOVE THEIR SYSTEMS INTO THE CLOUD FIGURE 2.1: Growth in Spending on Cloud by Country, Examples 16% United States Tracking Canada Countries United Kingdom Poland Netherlands Brazil Australia Percentage of Total Spending on Public Cloud Services France Mexico Germany 8% Lagging Russia Countries Italy China Turkey South Korea Spain Argentina Japan Resisting Indonesia Countries 0% 20% 40% Growth in IT Spending on Public Cloud Services (CAGR 2017-2022) Source: Cloudzero3 Many governments have realized that the earlier they embrace the cloud, the more they can benefit from it 2.1 CLOUD FIRST POLICIES and provide advanced services to their citizens. Many of the services and capabilities that they would otherwise At present, many countries have established policies need to build from scratch—and even entity by entity— for government agencies to choose cloud computing can be deployed “out of the box” from the cloud. Cloud by default and as a first choice.4 These policies are computing can help developing economies to leapfrog adopted in slightly different ways from country to legacy systems and quickly become providers of “citizen country, but in general they fall under some form of experiences” through government services.3 a “cloud first” policy. Beginning in 2010, a cloud first 3 https://www.cloudzero.com/blog/cloud-computing-statistics/ 4 See for example: https://www.cst.gov.sa/ar/mediacenter/researchsandstudies/Documents/anovervierontheglobalgovernmentaleffortsonfosteringtheuseofcloudcomputing.pdf 11 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 2. THE CLOUD IMPERATIVE: WHY GOVERNMENTS NEED TO MOVE THEIR SYSTEMS INTO THE CLOUD policy has become the institutionalized approach to the diversity of the different government agencies’ IT infrastructure investments worldwide. The policy requirements and services. serves as a strategic framework for organizations, especially within government and large institutions, Finally, for some developing countries that for one to prioritize cloud solutions over traditional or legacy reason or another do not have extensive legacy IT systems. The policy dictates that when there is systems, a cloud first policy can enable a direct a need for new IT services or upgrades to existing leapfrog to advanced cloud solutions, while legacy systems, cloud-based services should be considered systems often bog down developed countries. China the preferred option. For example, the United States provides an example of companies skipping legacy IT has had a cloud first policy since 2011, the United and moving straight to public cloud (Liang et al., 2017). Kingdom since 2013, and Australia since 2014. The main differences between these approaches are whether In summary, a thoughtful cloud first policy is often public agencies retain freedom to choose the cloud necessary to accelerate cloud adoption in governments solutions or not, the budget model, the governance, by overcoming inertia, providing enabling guidance, the approach to the security of the data, and the driving prioritization of cloud while allowing flexibility, level of centralization (e.g., shared government cloud and potentially enabling leapfrogging of legacy IT. platform in the Philippines vs. more decentralized approach in the U.S. and Australia). However, the common theme is to prioritize cloud solutions by default while providing resources to help agencies 2.2 CLOUD DEPLOYMENT AND evaluate options, comply with security requirements, SERVICE MODELS FOR PUBLIC and procure services more easily. Common traits of cloud first policies involve: (i) subverting the cultural SERVICES approach to ownership and control; (ii) helping with key competencies and guidance including regulation When discussing the use of cloud services by and security; (iii) supporting the cloud prioritization governments, which deal with highly sensitive data, process; and (iv) pushing for the leapfrogging of legacy from personal data to data that could affect national systems. security, it is important to distinguish between the cloud deployment models and cloud service A well-designed cloud first policy provides guidance models, specifically thinking about the regulated to agencies on critical issues like data classification environments in which they will be deployed. Cloud (what data can be put on public vs. private clouds), deployment models define the structure of the cloud regulatory compliance, budgeting for cloud, and solution while cloud service models define what is approaches for low-connectivity environments. provided on the cloud solution by the cloud provider. Such guidance enables agencies to make informed Both these models have been discussed extensively decisions while providing flexibility for them to choose in the literature and in other World Bank publications; non-cloud options if these provide better security, this is a summary of the highlights. flexibility, and value for money. For many countries it is important to avoid one-size-fits-all mandates given THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 12 2. THE CLOUD IMPERATIVE: WHY GOVERNMENTS NEED TO MOVE THEIR SYSTEMS INTO THE CLOUD clouds require more upfront investment and specialized 2.3 CLOUD DEPLOYMENT MODELS IT staff to manage them. Given the sensitive nature IN REGULATED ENVIRONMENTS of government data, private clouds are often used by government agencies, financial institutions, and large PUBLIC CLOUD enterprises with business-critical operations. This is the most common interpretation of cloud computing. In a public cloud, the cloud infrastructure is owned and managed by a third-party cloud service COMMUNITY CLOUD provider and shared among multiple organizations. A community cloud is a variant of a private cloud that serves several organizations with similar requirements, Key characteristics include: making it an interesting solution for governments with multiple needs for specialized services and for z Resources like servers and storage are shared sharing data. In a community cloud, the infrastructure and accessible over the public internet is shared among organizations in a specific community, z Highly scalable and flexible to meet demand like healthcare or education. Community clouds enable surges collaboration and resource sharing while meeting the security and compliance needs that are common to z Cost-effective, as the client only pays for the all the organizations in the community. From a cost resources used perspective, community clouds are more cost-effective z Minimal upfront investment and no than private clouds, but less so than public clouds. In infrastructure management required terms of capabilities, community clouds require high IT z May be considered as having lower security and cloud capabilities and high IT governance capabilities. compliance capabilities compared to private Community clouds are suited for organizations in highly clouds regulated environments that need or can benefit from sharing applications and data. Public clouds are well-suited for web applications, development environments, and big data processing. HYBRID CLOUD A hybrid cloud combines public and private PRIVATE CLOUD cloud infrastructure and eventually on-premises A private cloud consists of cloud infrastructure used infrastructure, allowing data and applications to exclusively by a single organization. It can be hosted move between them. It is the most advanced and most on-premises or by a third-party provider. In comparison complex cloud deployment model. With a hybrid cloud, to a public cloud, private clouds dedicate hardware, sensitive data can reside in the private cloud or even software, and infrastructure to one organization. For on-premises, while less-critical workloads can run on this reason, they enable higher levels of security, public cloud resources. In comparison to on-premises privacy, and control, and therefore can meet stricter solutions, a hybrid cloud can enable “cloud bursting”— compliance requirements as established by a specific tapping into public cloud capacity to handle spikes agency. Private clouds are also more customizable to an in demand—and therefore can provide flexibility to organization’s specific needs. For these reasons, private scale computing resources as needed. Over time, it 13 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 2. THE CLOUD IMPERATIVE: WHY GOVERNMENTS NEED TO MOVE THEIR SYSTEMS INTO THE CLOUD can allow for gradual migration to the private cloud, The cloud provider manages the physical data center, which means that users can continue to use their including hardware, network infrastructure, power, existing, legacy on-premises investments for a longer and security. IaaS is a good compromise for the more time. Hybrid clouds offer the benefits of public clouds sensitive aspects of government like defense. In these (like scalability) plus the security and control of private cases, a commonly used IaaS is Amazon GovCloud clouds. However, they are also the costliest solution (where available). IaaS provides flexibility but it since they do not offset the cost of on-premises requires the client to have a cloud-literate IT workforce solutions but rather add to the integration costs. They to properly configure applications. are also the most demanding model in terms of the required IT capabilities. For these reasons, hybrid clouds should be prioritized in government agencies PLATFORM AS A SERVICE (PAAS) with high requirements for data security and specific With PaaS, the government agency deploys internally strategic processes, or for those that want to maximize developed or acquired applications on platforms on-premises investments. supported by the cloud provider. The agency is responsible for provisioning and configuring cloud platform resources and deploying and managing 2.4 CLOUD SERVICE MODELS IN applications. The provider is responsible for the REGULATED ENVIRONMENTS underlying infrastructure and platforms, including network, servers, operating systems, and storage. PaaS There are three main cloud service models used in requires a similar risk management capability as SaaS, highly regulated environments such as government but with additional client responsibilities for managing and defense: (i) Infrastructure as a Service (IaaS), (ii) applications and platform resources. Platform as a Service (PaaS), and (iii) Software as a Service (SaaS). Each model offers different levels of control on the data and distribution of responsibility SOFTWARE AS A SERVICE (SAAS) between the cloud service provider and the client SaaS is like traditional outsourcing, where the organization. Please refer to Figure 2.2 for a comparison client uses the provider’s software applications. between the different cloud computing service models The client does not typically manage the underlying (IaaS, PaaS, and SaaS) and the degree of management cloud infrastructure nor the individual application by the service provider versus the client. capabilities, but is responsible for user-specific application configurations, user access and identity management, and overall risk management of the cloud INFRASTRUCTURE AS A SERVICE (IAAS) provider relationship. The provider is responsible for In the IaaS model, the client deploys and operates any application changes and maintenance, and the system software, including operating systems and underlying infrastructure. For many, less critical, and applications, on the cloud provider’s infrastructure. The more routine tasks, governments have transitioned to client is responsible for provisioning and configuring SaaS offerings like Microsoft Office 365. As cloud services cloud resources, applications, operating systems, and expand and increase their compliance with highly data storage, and for designing systems to work with regulated environments, governments can increase the provider’s resilience and recovery capabilities. their reliance on SaaS, allowing rapid integration of THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 14 2. THE CLOUD IMPERATIVE: WHY GOVERNMENTS NEED TO MOVE THEIR SYSTEMS INTO THE CLOUD work products and enabling employees to focus on the safety, soundness, and protection of their data and services rather than IT implementations. operations in the cloud environment. Highly regulated government organizations must carefully manage the The specific division of responsibilities between altered balance of data visibility and control that comes client and provider will vary for each deployment with transitioning to the cloud. across all models. Regardless of the model used, the public agency retains overall responsibility for the FIGURE 2.2: Comparison of Cloud Computing Service Models: IaaS, PaaS, and SaaS On-site IaaS PaaS SaaS Applications Applications Applications Applications Data Data Data Data Runtime Runtime Runtime Runtime Middleware Middleware Middleware Middleware O/S O/S O/S O/S Virtualization Virtualization Virtualization Virtualization Servers Servers Servers Servers Storage Storage Storage Storage Networking Networking Networking Networking You Manage Service Provider Manages Source: RedHat 15 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA SAUDI ARABIA’S STRATEGY AND 3 PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM The Kingdom of Saudi Arabia (KSA) has identified cloud computing infrastructure development and service adoption as key enablers for accomplishing the aspirational visions and objectives set out in Vision 2030. Recognizing the transformative and scalable potential DGA’s Government Cloud Office (GCO) was established of cloud technologies, the KSA government has to strategically launch, oversee, and operate cloud prioritized initiatives aimed at harnessing the power adoption programs in the kingdom. Specifically, its of the cloud to increase the efficiency of government mandate is to (i) plan and develop the cloud strategy spending on digital services, and as a result increase the that will accelerate the adoption by identifying quality of digital government services and beneficiary the current status of supply and demand gaps, (ii) satisfaction, among other strategic objectives. Cloud provide strategic support to government entities computing has become a critical component of the such as feasibility studies, financial planning, and nation’s digital transformation journey. developing and implementing awareness plans and training programs to build internal capabilities, and These initiatives aim to increase the level of cloud lastly (iii) monitor government entities’ compliance adoption in government entities to 50% by 2025, with regulations and spending efficiency in relation to up from 25% in 2024. By 2029, KSA’s cloud services cloud services. market size is expected to reach $8.8 billion. 5 The 5 Saudi Arabia Cloud Services Market Size & Share Analysis - Growth Trends & Forecasts (2024 - 2029). https://www.mordorintelligence.com/industry-reports/saudi-arabia-cloud-services-market THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 16 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM The GCO’s mandate reflects the top-down approach by VISION 2030 the KSA Government to lead the country’s transition to the cloud. This top-down approach starts with the KSA’s Vision 2030 is an ambitious roadmap for the vision, followed by the strategy, legislation, regulations, future, launched by the Prime Minister in 2016. The policies, and guidelines, to finally reach the execution Vision is underpinned by three strategic themes: a layer. The government has actively collaborated with vibrant society, a thriving economy, and an ambitious industry and companies to support and facilitate their nation. Vision 2030 sets ambitious strategic objectives, cloud adoption, extending their attention beyond such as increasing the share of non-oil GDP, boosting government entities to foster a cloud ecosystem across the private sector, creating more jobs, enhancing the kingdom. human capital, promoting tourism and culture, and strengthening social and environmental sustainability. The plan also seeks to enhance the role of women and 3.1 VISION AND STRATEGY youth in the society and economy, and to foster a more open and tolerant society that respects values and traditions. The KSA Government has produced a vision along with a series of strategies and guidelines,6,7 to lead the KSA’s strategy for cloud computing infrastructure process toward a fully functional digital government. development and service adoption is aligned closely Across these documents, a common theme is for with Vision 2030 and aims to facilitate the advancement all agencies to transition to the cloud. A vision and of effective and efficient digital government services, strategies serve as the guiding principles essential fuel the drive for digital transformation across for the development of robust cloud computing various sectors, and act as a catalyst for economic infrastructure and its successful adoption. diversification, among other benefits. By leveraging cloud computing, the government’s goal is to unlock new opportunities for innovation, entrepreneurship, and job creation, while also fostering a conducive environment for technology-driven growth (Figure 3.1). 6 Vision 2030 - Overview. https://www.vision2030.gov.sa/en/vision-2030/ 7 Vision 2030. https://www.vision2030.gov.sa/media/rc0b5oy1/saudi_vision203.pdf 17 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM FIGURE 3.1: Leveraging Cloud Computing to Achieve Strategic Objectives of Vision 2030 Strategic Objectives Cloud Contribution Enhance e ectiveness of Cloud adoption enables sustainable digital 5.1.1 financial planning and investment through IT assets and data e ciency of government consolidation thereby removing duplications, spending and achieving scalability and standardization VISION 2030 Develop the Cloud adoption enhances e-government "A sophisticated 5.2.4 e-government services and accelerates the digital government digital infrastructure is integral to today's Attract foreign The evolving governmental demand for direct investment cloud infrastructure and services would advanced industrial 3.1.6 attract foreign cloud service providers to invest in KSA activities" Develop the Cloud adoption enables digital 3.3.2 digital economy innovation to foster a sustainable digital economy Support national Enable local champions to thrive and to 3.7.1 champions to consolidate scale their expertise at a global level their leadership globally Develop promising local Cloud adoption will enable service 3.7.2 companies into regional providers and cloud based companies to and global leaders expand beyond KSA market DIGITAL GOVERNMENT STRATEGY 2023 – 2030 KSA’s Digital Government Strategy8 establishes the goal of providing world-class digital government services by 2030 to effectively and efficiently meet the needs of its citizens. The Strategy has identified twenty- four programs to support six strategic pillars (Figure 3.2). The Strategy’s initiatives are aligned with the UN Sustainable Development Goals (SDGs) and Vision 2030. Under the Strategy, cloud computing plays a key role in accelerating the digital transformation of KSA. 8 Digital Government Strategy 2023-2030. https://www.my.gov.sa/wps/portal/snp/aboutksa/digitaltransformation/ THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 18 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM FIGURE 3.2: The Digital Government Strategy 2023-2030 Comprises 24 Programs Supporting 6 Strategic Pillars9 A pioneering Top 10 Digital Government for a Vibrant Nation Mission Mission: To achieve seamless and integrated digital government services by leveraging the value of technologies and placing beneficiaries at the heart of the delivery Satisfied Enabled E ective E cient Regulated Citizen Business Government Investment Ecosystem 1.1A 2.1A 3.1A 4.1A 5.1A Applying the Develop Support Adopt free and Build digital concept of life business government open source policies and journeys sector services decision making so tware regulations/ and foresight Develop digital government 1.2A 2.1A 3.1B 4.1B 5.2B Whole of Provide digital Develop Raised the return on Develop digital government government Shared/Common investment and government platform assets to government achieve the e ciency measures and businesses platforms of government indicators and procurement - SDIF ensure compliance 1.2B 3.2A 4.2A 5.2C Promote public Build common Grow digital Activate the use consultations and government private sector of digital identity e-participation infrastructure participation and trust services Expedited Transformation 6.1A 6.2A 6.3A 6.4A 6.5A Strengthen Develop digital Transform Enable change Strengthen partnerships and skills in the government to management and governance and international government depend fully on communication institutional work presence sector - QTECH6 Cloud Services 6.1B 6.3A 6.3C 6.5A Raise the Transform Raise the level of Kingdom's ranking government to quality and Build the future of in international depend fully on availability of digital government indicators Cloud Services open government data 6.3E Rely on the best methodologies and achieve Govt. Excellence 9 KSA Digital Transformation Strategy: https://www.my.gov.sa/wps/portal/snp/aboutksa/digitaltransformation/ 19 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM NATIONAL TRANSFORMATION PROGRAM among data-driven economies. SDAIA is tasked with guiding the execution of the strategy within The National Transformation Program aims to government entities and implementing SDAIA- develop the necessary infrastructure and create an led initiatives. The Strategy focuses on priority environment that enables the public, private, and sectors such as education, government, healthcare, non-profit sectors to achieve Vision 2030. This will be energy, and mobility. It aims to leverage data and AI accomplished by achieving governmental operational technology to propel the country toward becoming a excellence, supporting digital transformation, enabling leading data-driven economy. Specifically, the Strategy the private sector, developing economic partnerships, has led to the creation of national data banks and and promoting social development, in addition to cloud infrastructures that enable secure and efficient ensuring the sustainability of vital resources. In the data sharing among government entities. Targets have first phase (2016-2020), the Program contributed to been set to train 20,000 specialists and experts, foster many important accomplishments. For example, the 300 active startups, and attract $20 billion in both Saudi Ministry of Health (MOH) entered a partnership national and foreign investments in data and AI.12 with IBM to develop a cloud-based health information These initiatives are expected to help KSA achieve the system (HIS). The HIS is designed to improve access national priorities outlined in Vision 2030 and position to patient data, streamline clinical workflows, and the country to emerge as a global frontrunner in the enhance overall healthcare delivery. With the HIS, utilization of data and AI well beyond the year 2030. health professionals can access patient records from anywhere, anytime via secure cloud-based servers. In the next phase (2021-2025), the Program will continue 3.2 LEGISLATION, REGULATIONS, developing the required infrastructure, enhancing POLICIES, AND GUIDELINES social development, ensuring the sustainability of vital resources, achieving governmental operational Legislation, regulations, policies, and implementation excellence, supporting digital transformation, and guidelines are vital to the development and adoption increasing the attractiveness of the labour market to of cloud computing infrastructure and services. They create an environment that enables the public and establish the necessary framework for infrastructure private sectors to achieve Vision 2030 development, service provision, data protection, privacy, compliance, and adoption by agencies. The NATIONAL STRATEGY FOR DATA & AI KSA government has taken significant steps to promote the development of cloud computing by implementing The National Strategy for Data & AI (NSDAI)10,11 was various pieces of legislation, policies, and regulations. established in July 2020 by the Saudi Data & AI Key initiatives can be found on the following page. Authority (SDAIA) to elevate KSA as a global leader 10 NSDAI. https://ai.sa/ 11 National Strategy for Data & AI (NSDAI) – Realizing Our Best Tomorrow, strategy Narrative. 2020. https://ai.sa/Brochure_NSDAI_Summit%20version_EN.pdf 12 Arab News. Saudi Arabia’s $20bn bid to lead the world in artificial intelligence. Oct 2020. https://www.arabnews.com/node/1752096/saudi-arabia THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 20 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM CLOUD FIRST POLICY Controls (ECC – 1: 2018). The CCC aims to set cybersecurity requirements for cloud In October 2020, the Ministry of Communications and computing from the perspective of CSPs Information Technology introduced the KSA Cloud First and Cloud Service Tenants (CSTs); to Policy,13 which aims to expedite the adoption of cloud meet security needs and raise the CSPs’ computing services. The Policy directs governmental and the CSTs’ preparedness for reducing entities to prioritize cloud options over traditional cybersecurity risks on all cloud computing solutions when making new IT investment decisions. services. z In addition, the NCA extended its initial Key highlights of the Policy are: “Essential Cybersecurity Controls” with a z Civilian government entities are required dedicated edition to cover “Cloud Cybersecurity to consider cloud solutions over internal or Controls.” It further released “Critical Systems traditional options for all new IT investments. Cybersecurity Controls” that cover critical systems. Some of control examples are “ Data z Unless specified otherwise in the policy, and Information Protection”, which is related civilian government entities are prohibited to securing export, and transfer data, as well from purchasing or constructing new data as the virtual infrastructure requirements. center infrastructure. Government entities should prioritize cloud z Construction of data centers is restricted to solutions from Software as a Service (SaaS), government-owned Cloud Service Providers then Platform as a Service (PaaS), and lastly (CSPs), such as the National Information Center Infrastructure as a Service (IaaS). (NIC). z When transitioning to cloud services, Aligned with the strategy of the National Information government entities are advised to prioritize Center 15 (NIC), the Cloud First Policy underscores approved commercial government CSPs, except the government’s commitment to modernizing IT for data classified as secret or above, which infrastructure and enhancing efficiency (Figure 3.4), must be hosted exclusively by government thereby also aligning with the key pillars of Vision CSPs. 2030. Box 3.1 below presents the desired outcome of the z Cybersecurity requirements set forth by Cloud First Policy as expressed by the Assistant Deputy the National Cybersecurity Authority (NCA)14 Minister for Technology and Investment. are mandatory for CSPs seeking to serve government entities. { NCA has developed Cloud Cybersecurity Controls (CCC – 1: 2020) as an extension and a complement to Essential Cybersecurity 13 Cloud First Policy. Oct 2020. https://www.mcit.gov.sa/sites/default/files/cloud_policy_en.pdf 14 https://www.nca.gov.sa/en 15 https://www.moi.gov.sa/wps/wcm/connect/e5077807-2ee5-45a8-8a33-55a99d30aa8f/NIC+Strategic+Plan+2014-2016_English+Summary.pdf?MOD=AJPERES 21 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM BOX 3.1: KSA’s Drive to Accelerate Digital Transformation with Cloud First “From the regulatory point of view, Cloud-first policy issued in 2020 contributed heavily to killing some of the myths that government entities have around cloud adoption. Pushing government entities to move to cloud and discouraging investments in new data centers, the government has aligned the regulatory frameworks to make sure cloud adoption is the way to go. We aim to push the public sector to adopt all these ready-made, well-proven, well-tested and widely adopted standards and platforms that are scalable and available within few minutes that can save time and money and drive businesses to innovate, instead of lifting and shifting legacy workloads.” ENG. NASSER ALNASSER, Assistant Deputy Minister for Technology and Investment, MCIT. THE TELECOMMUNICATIONS AND providers, within the ambit of the updated Act. It should INFORMATION TECHNOLOGY ACT be noted that Article 23 of the Act has an impact on cloud service providers, since they are required to take KSA’s Telecommunications and Information Technology all measures necessary for protecting users’ information Act,16 enacted by Royal Decree No. M/106, entered into and personal data, which cannot be disclosed without effect in December 2022. The Ministry of Communications prior consent from the data subjects. The service and Information Technology (MCIT) is responsible for providers are also mandated to report any security overseeing and enforcing the Act, which replaced the breaches or incidents to both the Communications, previous Telecommunications Law. The Act broadens the Space & Technology Commission (CST) and affected scope of the regulation from purely telecommunications users. services (under the previous law) to include new forms of ICT technology and digital services, with a specific NATIONAL DATA GOVERNANCE & focus on promoting digital transformation in the country. MANAGEMENT The Act defines information technology in broad terms to include “technologies, software, systems, networks Released in 2020 by the National Data Management and related processes used to create, collect, obtain, Office (NDMO),17 the National Data Governance Interim process, store or analyze data or information, including Regulations18 set out the framework for national data telecommunications and information technology governance, drawing from global best practices and applications”. This regulatory expansion brings a range standards. The first step is for government agencies, of digital service providers, including cloud service through an impact assessment, to determine the data 16 Telecommunication and Information Technology Act . LA _001_E_ Telecom Act English.pdf (cst.gov.sa) 17 The National Data Management Office is organized under the SDAIA and is responsible for establishing data policies and standards, developing data governance mechanisms, and monitoring compliance with the policies and standards. https://sdaia.gov.sa/en/Sectors/NDMO/Pages/default.aspx# 18 National Data Governance Interim Regulations. June 2020. https://sdaia.gov.sa/ndmo/Files/PoliciesEn.pdf THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 22 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM classification level (i.e,” Public,”” Restricted”) of all Accreditation and registration of CSPs government data. The impact assessment is based on CSPs in Saudi Arabia are categorized by the MICT and the possible impact of, for example, the unauthorized the CST into three categories (A, B, C). All categories of disclosure, access, amendment, or destruction of CSPs are authorized by the Communications, Space & any given piece of data. This determination of data Technology Commission (CST) to offer cloud services to classification levels is guided by principles including private sector establishments and individuals, although open-by-default, necessity-based classification, and the CST also gives each category of CSPs specific segregation of duties. Then, appropriate controls permissions regarding the processing of government (marking, access, usage, storage, data sharing, data. Class A CSPs are permitted to handle government retention, disposal, archival, and declassification) are data up to the “Public” classification; Class B CSPs can applied to data based on its classification level. process “Restricted” government data; and Class C CSPs are allowed to process government data of all In 2021, NDMO released the Data Management and classifications. Additionally, CST offers a “qualifying Personal Data Protection Standards19 to further bolster category” track for providers to begin providing cloud data quality, security, privacy, interoperability, and computing services while working toward meeting the value realization of the benefits not only for public requirements of the three basic categories. CSPs must agencies, but also for the private sector. The standards inform their service users/subscribers of their relevant also include personal data protection measures to category as registered with the CST. safeguard the rights of data subjects. Protection of personal data is further enshrined in KSA’s Personal Data Protection Law20 (PDPL), which defines rights Transfer of user/subscriber content and obligations of data subjects and controllers, Unless expressly stated, all government data are data protection principles and measures, data breach prohibited from being transferred out of the country, notification and response policies, as well as cross- whether permanently or temporarily (for data caching, border data transfer. backup, or similar purposes). This requirement applies to both CSPs and service users/subscribers. As for CLOUD COMPUTING SERVICES non-government data, CSPs must obtain prior consent PROVISIONING REGULATIONS21 from users before transferring, storing, or processing their data outside of the country, whether permanently Introduced in Oct 2023, KSA’s Cloud Computing Services or temporarily. Provisioning Regulations21 represent the most recent iteration of the cloud computing regulatory framework. This set of regulations is designed to offer clear guidance Reporting data breaches regarding the provision of cloud computing services in CSPs are required to promptly notify CST and the country and thereby foster regulatory clarity across affected users of any breaches involving their data all sectors. The Regulations set out the obligations of and information. If the breaches are likely to involve both cloud service providers (CSPs) and cloud service government data or affect many people, the reporting users/subscribers with respect to: must be escalated to the National Data Management Office (NDMO). 19 Data Management and Personal Data Protection Standards. Jan 2021. https://sdaia.gov.sa/ndmo/Files/PoliciesEn001.pdf 20 PDPL . Mar 2023. https://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Reviewed-.pdf 23 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM Cloud service provision contracts Service contracts must clearly stipulate service types, terms of use, levels of service, payment mechanisms, and the CSP categories registered with CST. Both the CSPs and users have the right to refer their disputes to any dispute resolution procedures made available by CST. Additionally, upon termination of service contracts, CSPs are obligated to return all user data and information in accordance with terms outlined in the contracts. GUIDELINE FOR CLOUD ADOPTION BY GOVERNMENT AGENCIES In September 2023, the Digital Government Agency (DGA) issued the Guideline for Cloud Adoption by Government Agencies21 to provide direction to government agencies in their cloud computing adoption journeys. The Guideline covers topics including data classification, security requirements, service models, deployment models, and a cloud adoption roadmap. It provides comprehensive guidance for the entire cloud adoption process, from application portfolio assessment, strategy scoping, operating model, and selecting cloud service providers to migrating current services to the cloud computing system (Figure 3.3 on the following page). In addition, the Guideline also includes a target to reach “50% of government agencies’ adoption of cloud services by 2025.” The Saudi government is conscious that the move toward the cloud, while extremely valuable, in practice also presents extreme challenges in achieving the desired success. It requires a complete overhaul of the government operating model to fully embrace the benefits that the cloud can bring. 21 Guideline for Cloud Adoption by Government Agencies. Sep 2023. https://dga.gov.sa/sites/default/files/2023-09/Guideline%20 for%20Cloud%20Computing%20Adoption%20by%20Government%20 Agencies%20%E2%80%93%20V1.0_1.pdf THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 24 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM FIGURE 3.3: Cloud Adoption Process for Government Agencies Inputs National Data Governance Cloud Computing L1 Interim Regulations Regulatory Framework L2 12.0-CSP 6.0-Are you 10.0-Can your Certification Govt. Start: New IT 2.0-Is the requirements be Data Classified exempted from Level Identify Investment met by Agency Decision Public Cloud Commercial CSPs Cloud Service Provider Class based on Identified Data Classification 1.0 Regulatory Compliance 7.0-Can your requirements be 11.0-Prepare a 13.0-Application met by business case Migration Check Source Approach of Regulatory Govt. Cloud A business case Compliance should be Government prepared to agency decides support DGA in to migrate accepting applications & 5.0-Data migrating workloads to Classification 13.0 agency services Commercial / to Govt. Cloud Community cloud Classify your data as restricted 8.0-Host on 14.0-Workloads Government Cloud Identification Identify 4.0-Were you Start hosting your Workloads that capable to services on will be migrated classify your Government Cloud to Cloud Data 9.0-Host on Private Cloud End Start hosting your services on Private Cloud 3.5-Data Classification Other Enablers Guidance L1 L2 Refer to Data Classification Policy released by NDMO Outputs L2 Identification of Data Business Case Identification of CSP Classification Certification Level (Top Secret, Secret, (A, B or C) Restricted, Public) Source: Guideline for Cloud Adoption by Government Agencies. September 2023. 25 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM Therefore, the GCO has established a series of practices attractive. It will spur the build-up of additional cloud to accelerate the adoption of cloud computing capabilities within Saudi Government agencies and services within government agencies. This program, their employees, further increasing the attractiveness the Cloud Adoption Acceleration Program, is led by of the Kingdom to global CSPs and accelerating the the DGA and focuses on enhancing capabilities and adoption of cloud. In this best-case-scenario vision providing strategic support to transition agencies of the transition to cloud, cloud-based services, from traditional computing environments to dynamic, cloud providers and their platforms, and government scalable, and collaborative cloud environments.22 The entities (along with their employees) together create a program’s objectives include fostering awareness of cloud-enabled digital ecosystem that can self-sustain cloud services, increasing the maturity and readiness if nurtured in the right way. To advance this ecosystem of government agencies for cloud adoption, providing vision, the DGA and the Government Cloud Office (GCO) pioneered cloud solutions, accelerating the delivery located in DGA have established a robust mechanism of digital governmental services, providing integrated to motivate the supply side of the cloud ecosystem. digital experiences, and raising overall satisfaction with The GCO works hand-in-hand with other government governmental services among citizens. entities to ensure that the adoption of cloud solutions is prioritized where and when needed. The recent The acceleration process begins by raising awareness encouraging announcements from various globally of the benefits of the cloud and supporting public leading CSPs to enter the market with significant entities in the early steps of their journey. The investments and provide leading capabilities to the self-reinforcing positive feedback loops of a cloud kingdom are a strong sign of the confidence that CSPs ecosystem can further help motivate the transition. have in the overall KSA cloud market. The entry of Cloud adoption leads to better, faster, and more highly multiple players into the market will furthermore performing government services once processes increase competition and drive overall maturity of have been digitized. This virtuous cycle will make the whole ecosystem. cloud providers’ investments in the Kingdom more BOX 3.2: CSP Investments in the KSA Microsoft has already announced plans to expand cloud investments in the Kingdom, aiming to empower local and international organizations with high-grade cloud services. Likewise, Oracle has committed $1.5 billion to meet the growing demand for cloud services and is working with local entities to foster the cloud industry.23 222223 22 Cloud Adoption Acceleration Program for Government Entities. https://dga.gov.sa/en/programs/cloud-computing 23 https://www.oracle.com/news/announcement/oracle-to-invest-us-1-point-5-billion-to-meet-cloud-computing-demand-in-saudi-arabia-2023-02-06/ THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 26 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM From the demand side (public agencies), the not front runners, DGA’s GCO has launched a series transformational changes required to institutionalize of formative interventions to increase awareness cloud solutions can take very long time. DGA’s GCO is of the adoption targets and the benefits expected currently in the early stages of an ambitious multi-year from intensive usage of the cloud. As an example, cloud transformation process but is already seeing the DGA team has run several workshops with senior positive results. Several government entities have officials at government agencies to raise their overall successfully moved some of the IT workload to the familiarity with the cloud and their understanding of cloud. This has allowed the DGA to identify a set of the benefits associated with this technological change. front-runner agencies to whom they will soon offer In 2021, Saudi Arabia allocated $1.06 billion to upskill more support to accelerate their journey toward the 100,000 local digital talents.24 As new digital cloud cloud. As a first step, DGA’s GCO is focusing on driving technologies continue to transform the way people the adoption of readily available SaaS solutions to work and live, investing in digital cloud skills is no replace legacy on-premises applications. This is not longer a choice, but a necessity for the future Saudi only a cost-effective exercise; it also helps to instil Arabia economy. By upskilling the Saudi workforce to the discipline required to ensure compliance by meet the demands of the modern business landscape, these entities with security standards. The target is to these investments ensure that citizens have access to leverage those initiatives to achieve the goal of 50% the jobs and opportunities of tomorrow. adoption by the end of 2025. For agencies that are BOX 3.3: KSA’s Drive to Upskill its Digital Workforce “The ecosystem around talent has been substantially mature in the Kingdom; investment arms such as VCs and PEs, incubators, accelerators, and initiatives like The Garage, Code Lab and NTTP all empower the digital workforce. The rate of ICT workforce and the share of women within the sector is high compared to other leading countries. A lot of effort has been made in the last couple of years, 24 24 and today we are seeing the outcome of these efforts.” MAAN FARSI, General Manager, Cloud Computing and Partnerships, CST. 24 Telecom Review. KSA sets aside SR4 bn to upskill digital talents, unveils home-grown smart chips . Aug 2021. KSA sets aside SR4 bn to upskill digital talents, unveils home-grown smart chips - Telecom Review 27 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM TYPES OF CLOUD SERVICES IN THE KINGDOM 3.3 INSTITUTIONAL ARRANGEMENTS In KSA, three types of cloud services are deployed for government use: G-cloud (e.g., Deem), local cloud The alignment of organizations and institutions is (e.g., STC), and hyperscale cloud (e.g., Google). However, crucial to ensure that the development of cloud there is no primary cloud service provider, allowing infrastructure and services is strategically aligned government entities to choose CSP services based on with a nation’s overarching goals and business their classification by the Communications, Space & strategies. This alignment is instrumental to drive Technology Commission (CST), as introduced previously. digital transformation and stimulate economic expansion. Moreover, fostering close coordination To review, these classifications include: and collaboration across the entire government and among various agencies is essential to achieve a z CLASS C: The highest level, authorized for top synergistic approach that maximizes the benefits of secret, secret, restricted, and public data. cloud computing. The key organizations and institutions z CLASS B: Authorized for restricted and public involved in KSA’s move toward the cloud include: data. z CLASS A: Authorized solely for public data. Ministry of Communications and Information Technology (MCIT) The most popular services include Infrastructure as a Responsible for developing and maintaining the Cloud Service (IaaS), Platform as a Service (PaaS), Software First Policy. Under the National Transformation Program as a Service (SaaS), and cloud-based storage solutions. 2020,25 MCIT leads the following initiatives (among others): (i) Develop skilled human capital and narrow To date, Saudi government agency systems migrated the digital divide in the ICT sector, (ii) Expedite the to SaaS platforms include Enterprise Resouce Planning development of digital government services on shared (ERP) systems, Customer Relation management (CRM) infrastructure, and (iii) Support the development of systems, content management systems, Desktop as a fixed and wireless broadband connectivity in all regions Service, and analytics and big data tools. PaaS platforms of the country. host portals, custom applications, and databases, while IaaS supports various applications and systems. Notably, some agencies use IaaS for disaster recovery Digital Government Authority (DGA) as a service (DRaaS). The criteria for these migrations Established in 2021 to drive the national agenda for typically involve scalability, cost-effectiveness, security, digital governments (with a particular focus on the and compatibility with existing infrastructure. The better delivery of government services)26 and to objective is to leverage cloud computing capabilities to regulate KSA’s government digital infrastructure, enhance efficiency, adaptability, and availability while including technology, to ensure that it is secure and ensuring compliance with regulatory obligations. efficient. 25 National Transformation Program 2020. https://planipolis.iiep.unesco.org/sites/default/files/ressources/saudi_arabia_ntp_en.pdf. 26 H.E. Alswaha : “Establishment of Digital Government Authority Opens New Horizons In Services”. Jul 2022. https://dga.gov.sa/en/node/119 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 28 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM BOX 3.4: KSA’s Drive to Accelerate Migrating Government Applications to the Cloud. “Successful cloud adoption will require a significant shift on various levels, which includes the skills and capabilities that we need in our entities and from our partners, the operating model on how we use and consume technology and how we think about government expenditure, given the shift from a CAPEX to an OPEX-based model. DGA’s GCO will be supporting the entities with practical guidelines and standards and will work with all other stakeholders in the kingdom to prepare and execute this shift successfully. We are well prepared – taking e.g., learnings from other countries that embarked on such a transition into account – but will depend on close collaboration with other entities to execute successfully. We will value any feedback early on, e.g., from our front-runner entities if there are things that need to be adjusted to further ease and enable seamless cloud adoption for the kingdom.” DR. KHALED ALHAZMI, Managing Director, GCO, DGA. Government Cloud Office (GCO) National Cyber Security Authority (NCA) Established to launch, oversee, and operate the cloud Responsible for developing national cybersecurity adoption program. This entails developing the cloud strategy, policies, frameworks, standards, controls, and strategy to accelerate the adoption of cloud services, guidelines.28 provide strategic support to government entities, and monitor government entities’ compliance with regulations and expectations for efficient spending in Communications, Space and Technology relation to cloud services. Commission (CST) Regulates 29 and oversees the registration and accreditation of cloud service providers, monitors National Data Management Office (NDMO) data breaches, and provides procedures for resolving Oversees data privacy and protection laws and disputes between service providers and cloud users.30 regulations, monitors compliance with policies and standards, and develops data classification and management standards.27 27 National Data Management Office (sdaia.gov.sa) 28 National Cybersecurity Authority (nca.gov.sa) 29 Guideline for Cloud Adoption by Government Agencies . Sep 2023. https://dga.gov.sa/sites/default/files/2023-09/Guideline%20for%20Cloud%20 Computing%20Adoption%20by%20Government%20Agencies%20%E2%80%93%20V1.0_1.pdf 30 Background (cst.gov.sa) 29 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM TABLE 1: Key Regulations Regulations Published by Descriptions CST Issued the Cloud computing regulatory framework in the Kingdom Cloud Computing based on the best international practice, Regulatory CST which includes the rights and Framework obligations of the service providers, (CCRF) individual customers, government entities and enterprises. KSA's "Cloud First Policy" is a policy that covers Governmental entities (as specified in the "Scope of the policy" section). The goal is to accelerate the KSA Cloud First adoption of Cloud computing services by MCIT Policy directing these entities to consider Cloud options when making new IT investment decisions. In addition, the private sector is encouraged to follow the same exercise with an internal CFP. NDMO, as the national regulator of data in the Kingdom, has developed the National Data National Data framework for national data governance Governance Management to set the policies and regulations Interim O ce (NDMO) required for data classification, data Regulations sharing, data privacy, Freedom of Information, open data, and others in anticipation of necessary legislation. The CCC is a comprehensive document Cloud specifying security controls for the National Cloud. Cybersecurity Cybersecurity Controls Authority (NCA) (CCC) The CCC has controls for CSP and customer and is developed as an extension of the ECC. THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 30 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM An enhanced need for scalable and secure 3.4 WORKING WITH INDUSTRY: z cloud solutions for public services is also CSPS AND LOCAL COMPANIES driving demand. Hospitals and healthcare providers are adopting cloud-based electronic KSA’s cloud services market is poised for significant health record (EHR) systems to ensure growth, with projections indicating it will reach seamless data sharing and enhance patient $8.8 billion by 2029.31 This momentum is driven by a outcomes. combination of regulatory clarity, investments, and the z A focus on cost efficiency and improved service nurturing of demand from local businesses in addition delivery will also incent agencies to look to to the public sector. Multiple regulations are now in cloud-based solutions. place that create clarity in the cloud provision market. On the investment front, public spending on cloud in Private Sector the country will exceed $2.5 billion by 2026.32 Finally, the z There is growing demand for cloud-based KSA authorities are also helping the local businesses in solutions to improve operational efficiency. their move to the cloud. Retailers are deploying cloud-based inventory management systems to streamline operations Demand side. and ensure real-time stock visibility. On the local business side, and aligned with efforts to z An emphasis on agility and flexibility in bolster the country’s position as an innovation hub, business operations is also a demand driver. the KSA government has been backing and supporting SMEs and startups are increasingly turning to companies, SMEs, and tech startups through MCIT’s cloud solutions for cost-effective, scalable, and National Technology Program. These incentive flexible IT infrastructure from the beginning of programs for companies include initiatives such as their operations. “Accelerators Enablement,” “Saudi Unicorns,” “NextEra,” z There is a need for data storage and processing “Grow your Tech Business,” and “Connect,” which assist capabilities to support business intelligence SMEs and tech startups to adopt new technology and and analytics, which are both well-suited to build new innovative products and services. Below is cloud-based solutions. Banks are using cloud summarized the demand sources for the public and computing to implement advanced analytics private sectors. and AI-driven insights, improving fraud detection and personalized banking services. Public Sector z Government initiatives driving digital Supply side. transformation as the government’s Cloud First Policy mandates the adoption of cloud The massive opportunity for annual growth puts solutions across public sector agencies. pressure on suppliers—they must continue to invest, 31 Saudi Arabia Cloud Services Market Size & Share Analysis - Growth Trends & Forecasts (2024 - 2029). https://www.mordorintelligence.com/industry-reports/saudi-arabia-cloud-services-market 32 IDC. Saudi Arabia Public Cloud Market 2021 Analysis and 2022–2026 Forecast. Oct 2022. https://www.idc.com/getdoc.jsp?containerId=META49112722 31 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM expand, offer competitive prices, manage costs Madi, country manager at Google Cloud, “the effectively, and diversify to distinguish themselves. technology will benefit the banking sector, Suppliers are working to attract SMEs and startups, insurance sector, and the fast-emerging which would give them access to clients at an early fintech industry in the Kingdom.”35 stage and allow them to provide applications or z According to research commissioned by Google developments that can run on cloud from day one. Cloud and conducted by Access Partnership, the new cloud region that Google is launching One the CSP side, KSA is actively pursuing strategic in Damman will contribute a cumulative $109 partnerships with local and global tech companies to billion to the Saudi economy between 2024 and boost its cloud infrastructure and services. 2030, and add 148,600 jobs by 2030. 36 Oracle has established a hyperscale data Key initiatives include: z centre in the Neom Smart city to host cloud z In 2021, MCIT announced a collaboration with infrastructure, providing a high-performing and local and international companies to invest up resilient foundation for cloud services. 37 Oracle to $18 billion to build large-scale data centers also announced an investment of $1.5 billion to and renewable energy facilities, for hosting boost cloud capacity in the country. 38 cloud services, gaming, and content delivery z Al Moammar Information Systems (MIS) platforms. 33 and Saudi Fransi Capital have announced a z MCIT formed a strategic partnership with IBM partnership to create a private investment to upskill 100,000 citizens in AI, cybersecurity, fund to develop six data centers in Saudi and software interoperability in the company’s Arabia. 39 cloud and open technology centers. 34 z Microsoft has announced its intention to invest z Google Cloud and Saudi Aramco have in new cloud data center regions in KSA, in partnered to deliver high-performance, response to the growing demand for cloud low-latency cloud services, leveraging their services in the country from global enterprises, combined expertise and resources. The local businesses, and civilian public sector partnership with Google includes ambitions organizations.40 far beyond Aramco. According to Bader Al- 33 Asian Banker. How will data centre investments in the Middle East benefit the financial services industry? Feb 2022. How will data centre investments in the Middle East benefit the financial services industry?- The Asian Banker 34 MCIT. Boosting Saudi Arabia’s Positioning as Regional Hub for Technology and Innovation: Strategic Partnership with IBM to upskill 100,000 Saudis. Jul 2022. https://www.mcit.gov.sa/en/news/boosting-saudi-arabias-positioning-regional-hub-technology-and-innovation-strategic 35 Google Launches New Cloud Region in Saudi Arabia. Nov 2023. https://www.arabnews.com/node/2409331/business-economy 36 MIT Sloan Management Review. Spring 2024 Issue. https://www.mitsloanme.com/article/the-rise-and-rise-of-cloud-computing-in-saudi-arabia/ 37 Datatechvibe. NEOM Tech Signs Oracle As First Tenant Of Hyperscale Data Centre. Oct 2021. NEOM Tech Signs Oracle As First Tenant Of Hyperscale Data Centre (datatechvibe.com) 38 MIT Sloan Management Review. Spring 2024 Issue. https://www.mitsloanme.com/article/the-rise-and-rise-of-cloud-computing-in-saudi-arabia/ 39 Datacenter Dyanmics. MIS & Saudi Fransi Capital establish new fund to build data centers in Saudi Arabia. Jun 2021. https://www.datacenterdynamics. com/en/news/mis-saudi-fransi-capital-establish-new-fund-to-build-data-centers-in-saudi-arabia/ 40 Microsoft. Saudi Arabia Cloud Datacenter Region. Feb 2023. https://news.microsoft.com/en-xm/features/microsoft-announces-intent-to-expand- cloud-regions-through-saudi-arabia-datacenter/ THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 32 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM z SAP and MCIT have entered into an agreement and secure cloud services for government, to collaborate in various areas of cooperation, corporate and individuals.43 which includes training and knowledge transfer z Saudi Aramco and Zoom announced a strategic initiatives, leveraging SAP’s cloud and on- partnership to build Zoom’s first global data premises software solutions.41 center in KSA.44 z Saudi Telecom Company, KSA’s largest telecom z Alibaba Cloud has selected the King Abdullah operator, and eWTP Arabia Capital have Financial District (KAFD) as a key launchpad partnered with Alibaba Cloud to provide high- for its cloud services, further cementing Saudi performance public cloud service.42 Arabia’s position in the digital transformation z Huawei is to invest US$400 million in a cloud journey. Alibaba’s venture in the Kingdom is region in KSA over five years from 2023/2024. part of a broader strategy to enhance its global The funds will provide access to more advanced cloud infrastructure and service offerings.45 41 MCIT. MCIT Partners with SAP to Power Saudi Arabia’s Communications, Information Technology Landscape. Aug 2022. MCIT Partners with SAP to Power Saudi Arabia’s Communications, Information Technology Landscape | Ministry of Communications and Information Technology 42 Alibaba Cloud. Saudi Arabia all set to be the epicenter of operations for cloud computing technologies . Dec 2020. Saudi Arabia all set to be the epicenter of operations for cloud computing technologies - Alibaba Cloud Press Room 43 RCR Wireless News. Huawei to invest $400 million in Saudi Arabia cloud region. Feb 2023. Huawei to invest $400 million in Saudi Arabia cloud region (rcrwireless.com) 44 Aramco. Aramco makes two major announcements at LEAP 2023. Feb 2023. https://singapore.aramco.com/en/news-media/news/2023/aramco-makes- two-major-announcements-at-leap-2023 45 Alibaba Cloud’s JV Opens Two Data Centers in Saudi Arabia. Jun 2022. https://pandaily.com/alibaba-clouds-jv-opens-two-data-centers-in-saudi-arabia/ 33 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 3. SAUDI ARABIA’S STRATEGY AND PRACTICES TO ACCELERATE CLOUD ADOPTION IN THE PUBLIC SYSTEM z Informatica has launched Saudi Arabia’s first CLOUD COMPUTING AI-powered Intelligent Data Management Cloud SPECIAL ECONOMIC ZONE (IDMC) platform, marking a significant step towards fulfilling the country’s Vision 2030 To catalyze the development of cloud infrastructure, to become a cloud-first, digitally empowered in April 2023 the Economic Cities and Special Zones nation. The initiative includes a new Point of Authority launched a Cloud Computing Special Delivery in Riyadh, enhancing local cloud data Economic Zone (SEZ) located in the King Abdulaziz management services. This move aligns with City for Science and Technology. The SEZ is intended to the Saudi government’s strategy to transition facilitate the operation of data centers and provision to cloud-based systems and aims to double the of various cloud computing services.49,50 This special cloud computing sector’s contribution to the zone is one of the first in the MENA region, offering GDP, further positioning Riyadh’s economy as cloud service providers the flexibility and incentives data-driven. The platform, powered by CLAIRE to establish data centers across KSA, and the ability AI, offers comprehensive data management to provide various cloud computing services from the solutions to facilitate digital transformation in zone. the region.46 z In February 2024, Google announced that it As it should appear clear from this chapter, the would be investing $500 million to establish a transformational complexity that characterizes new cloud region in Saudi Arabia.47 moving an entire government infrastructure to the cloud requires an equally complex set of governance z Similarly, Amazon announced in April that it tools, practices, facilitating mechanisms and would be opening a new AWS region in Saudi incentives. It also takes time and steadfast effort to Arabia, which is expected to launch in 2023.48 institutionalize a new way of thinking. The next chapter explores the key takeaways from these initial steps and the challenges ahead. 46 Informatica Launches Saudi Arabia’s AI Powered Intelligent Data Management Cloud Platform https://www.businesswire.com/news/home/20240402439288/en/Informatica-Launches-Saudi-Arabia%E2%80%99s-First-AI-Powered-Intelligent-Data- Management-Cloud-Platform 47 Google Launches New Cloud Region in Saudi Arabia. https://www.arabnews.com/node/2409331/business-economy 48 AWS to launch an infrastructure region in the Kingdom of Saudi Arabia https://press.aboutamazon.com/2024/3/aws-to-launch-an-infrastructure-region-in-the-kingdom-of-saudi-arabia 49 Access Partnership. Access Alert: Saudi Arabia’s Cloud Computing Special Economic Zone. Jun 2023. https://accesspartnership.com/access-alert-saudi- arabias-cloud-computing-special-economic-zone/ 50 CST. Cloud Computing Special Economic Zone. https://www.cst.gov.sa/en/services/licensing/Pages/Cloud-Computing-Special-Economic-Zone.aspx THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 34 KEY TAKEAWAYS AND 4 CHALLENGES AHEAD The proactive strategy adopted by KSA to expedite cloud development offers useful insights for governments and policymakers facing similar challenges and constraints. Particularly noteworthy is the country’s resolute dedication and its synergistic approach involving leadership from the public sector. which requires investments in the development of its 4.1 KEY TAKEAWAYS ICT sector and digital infrastructure. This vision steers the country’s development toward innovative solutions This section summarizes some key lessons from the and ensures that these efforts align with its overarching KSA experience that warrant attention. business objectives. 4.1.1 ESTABLISH A NATIONAL For successful cloud computing initiatives, the ASPIRATION AND STRATEGY importance of a clear vision, complemented by robust strategies and their effective execution, cannot A well-defined vision and strategy are crucial to be overstated. In alignment with Vision 2030, KSA’s the advancement and adoption of cloud computing government authorities have developed detailed infrastructure and services. They serve as a blueprint strategies including the Digital Government Strategy for technological advancement and user engagement. 2023-2030 and the National Strategy for Data and AI, KSA’s Vision 2030 exemplifies this approach by setting which lay out specific actions, resource commitments, a clear national goal to diversify its oil-based economy, and timelines to realize the vision and achieve the 35 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 4. KEY TAKEAWAYS AND CHALLENGES AHEAD intended results. Furthermore, these strategies provide Furthermore, in October 2023, the Cloud Computing a framework for anticipating potential challenges, Services Provisioning Regulations were issued, offering planning for contingencies, and cultivating partnerships clear guidance for the accreditation and registration that support service adoption and expansion. of cloud service providers. Finally, the DGA issued the Guideline for Cloud Adoption by Government Agencies 4.1.2 ENSURE TIMELY IMPLEMENTATION OF in September 2023, which further stipulates governing LEGISLATIVE AND POLICY MEASURES rules on data classifications, security requirements, service models, and more. Legislation and regulations play a crucial role in the development of cloud computing infrastructure and 4.1.3 FOSTER COLLABORATION service adoption. They provide the foundational ACROSS INSTITUTIONS framework that governs infrastructure development, service provision, data protection, privacy, and The KSA government recognized the tendency for compliance. By operating within legal boundaries, agencies to operate in silos and has thus implemented these frameworks instill trust among users and mechanisms51 to address this issue. Despite significant facilitate broader adoption. Moreover, they promote efforts by the government to tackle the challenge across transparency, accountability, and fair competition the past few years, the challenge of “relatively high within the cloud industry, fostering innovation while fragmentation” within the public sector has proven to preventing potential misuse. These measures are vital be quite persistent. DGA has identified collaboration for preserving service quality and ensuring customer as a crucial success factor to address this challenge, satisfaction. and it supports efforts by the NCDT to track policy implementation and enhance collaboration among KSA offers an exemplary case of how timely legislative government entities. Collaboration across institutions and policy measures provide clarity and impetus for is a priority for the DGA as it works to integrate cloud cloud development and adoption in a country. Aligned technology throughout the ecosystem. This can be with Vision 2030 and its national transformation seen in how key performance indicators (KPIs) are agenda, MCIT introduced the Cloud First Policy in measured in its strategy, emphasizing its role as a October 2020. This policy articulates a clear stance for servant and facilitator. The primary KPIs leveraged government entities, urging them to take the lead on by the DGA include the adoption rate of public cloud and prioritize cloud options over traditional IT solutions services, the contribution of cloud technology to GDP, for new IT investments. Additionally, the policy prohibits annual growth in comparison to other countries, the government entities from purchasing or constructing availability of cloud services, and the readiness of cloud new data center infrastructure. infrastructure. 51 ITU, Country Review: Saudi Arabia’s digital transformation and collaboration regulation, 2022 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 36 4. KEY TAKEAWAYS AND CHALLENGES AHEAD BOX 4.1: Example of Integration, Collaboration, and Standardization. DGA has established a digital platform for knowledge sharing and collaboration, called the Government Services Bus (GSB). The GSB is a secure platform that enables government entities to share data, authenticate users, and collaborate on projects. This platform helps to break down silos and encourages greater collaboration across different agencies. In addition to these mechanisms, the DGA also provides guidance and support to government agencies on how to collaborate effectively. This includes training programs, workshops, and best practice sharing sessions. Through the CIO council created in 2021, the DGA has established a new communication channel to ensure close coordination across the different agencies. 4.1.4 EMPOWER THE PUBLIC SECTOR TO provisioning services and infrastructure adequate for PROACTIVELY LEADS CLOUD MIGRATION their everyday baseload (but capable of scaling up and then back down as needed). When the public sector takes the lead in adopting and migrating to the cloud, it can accelerate progress and The Government Cloud Office, at the DGA, supports inspire others, including the private sector, to follow government agencies’ cloud programs: From planning suit. The KSA government has been actively promoting and migration to selection of CSPs, and transition the use of cloud services to enhance efficiency and management. The GCO works closely with other relevant innovation in both the public and private sectors. As entities in the ecosystem (e.g., the CST), providing previously noted, the DGA introduced the Cloud Adoption practical guidelines and standards to unlock and enable Acceleration Program to drive the adoption and use of a seamless transition to cloud for individual entities and cloud computing among government agencies. This the kingdom. Additionally, GCO also applies learnings program includes raising awareness of cloud services, from around the globe to help KSA leapfrog to the enhancing the maturity and readiness of governmental latest developments and further accelerate adoption. agencies for cloud adoption, and improving overall Examples of such leapfrogging approaches include the satisfaction with governmental services. From an application of FinOps to manage cloud costs, and of entity point of view, this cloud-enabled ecosystem will security-as-code and compliance-as-code to ensure drastically ease or even enable the access to innovative safe and compliant adoption while eliminating the and complex services like Generative AI and allow the bottleneck of manual approvals. realization of greater efficiencies from investments. One example of increased efficiency is that the cloud- The setting of clear and ambitious adoption targets enabled ecosystem will allow entities to reduce demonstrates the KSA public sector’s proactive investments in spare, largely unused capacity (available commitment to the cloud transition. While the initial to handle peak loads in an on-premises scenario) by target was for 50% of KSA’s public agencies to have 37 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 4. KEY TAKEAWAYS AND CHALLENGES AHEAD adopted cloud by 2025, this target was subsequently 4.1.6 BOOST USER TRUST raised to 80% by 2030, demonstrating the Government’s TO SPUR THE CLOUD MARKET dedication and resolve to lead the change.52 The current adoption rate of cloud services in the KSA public sector The KSA’s Personal Data Protection Law55 (PDPL) stands at around 25%. However, there is still a long way regulates the collection, processing, protection, to go to reach even the 50% target by 2025. Under DGA, and transfer of personal data. It covers the rights of the GCO is actively working to encourage and facilitate data subjects, obligations of controllers, and ensures the adoption of cloud services among all government adequate levels of protection when personal data is entities. This is in line with the strategies of other transferred outside the KSA. Initially issued in 2021 leading governments, such as Singapore’s GovTech and subsequently amended in March 2023, the PDPL Agency, which successfully migrated 70% of its public empowers the competent authority (the Saudi Data & sector workload to the cloud by the end of 2023, as part Artificial Intelligence Authority, or SDAIA) to oversee of a five-year plan. the legislation, ensure compliance and handle complaints from data subjects.56 The release of the 4.1.5 ENABLE CLOUD ADOPTION BY accompanying Implementing Regulation57 shortly after PARTNERING WITH INDUSTRY AND the implementation of the PDPL was a crucial support PROVIDING SUPPORT TO COMPANIES for organizations as they work to adapt their business processes to meet its requirements. The KSA Government is taking an ecosystem approach to the creation of demand for and supply of cloud The PDPL provides the necessary legal framework services. On the demand side, there is a push for cloud to foster a healthy and dynamic cloud computing investments both in public agencies and in private ecosystem, thus spurring the cloud computing and organizations. On the supply side, the government service market. The law provides a clear personal has created a clear legal framework and provided the data protection framework, which reduces ambiguity public investments in infrastructure that will guarantee and uncertainty for businesses, including cloud the long-term viability of the cloud model. It has also service providers, and enables them to navigate legal created a Cloud Computing Special Economic Zone (SEZ) requirements more effectively. Through compliance in the King Abdulaziz City for Science and Technology to with the PDPL, cloud service providers can demonstrate boost the development of data centers and provision their commitment to protecting user data, thereby of cloud computing services.5354 increasing trust and encouraging greater adoption of cloud services. Businesses and consumers are increasingly prioritizing data privacy and security when 52 DGA. Cloud Computing Workshop, Dec 3, 2023. https://dga.gov.sa/en/news/dga-launching-Cloud-Computing-workshop 53 Access Partnership. Access Alert: Saudi Arabia’s Cloud Computing Special Economic Zone. Jun 2023. https://accesspartnership.com/access-alert-saudi- arabias-cloud-computing-special-economic-zone/ 54 CST. Cloud Computing Special Economic Zone. https://www.cst.gov.sa/en/services/licensing/Pages/Cloud-Computing-Special-Economic-Zone.aspx 55 SDAIA. KSA PDPL . 2023. https://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Reviewed-.pdf 56 Article 34, the PDPL. 57 SDAIA. Implementing Regulation of the PDPL . 2023. https://sdaia.gov.sa/en/SDAIA/about/Documents/ImplementingRegulation.pdf THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 38 4. KEY TAKEAWAYS AND CHALLENGES AHEAD selecting service providers. By adhering to the PDPL, dearth of skills and expertise in cloud operations is cloud providers can differentiate themselves in the hindering their companies’ ability to achieve business market and attract customers who value privacy and goals.59 Specifically, organizations struggle to recruit security. Additionally, when businesses have confidence individuals with expertise in crucial areas like cloud in the legal framework governing data handling, they architecture, security, and data management. Given are more likely to invest in developing and adopting the rapid acceleration of cloud adoption, addressing cloud-based solutions, leading to market growth and this talent gap is paramount for a successful digital technological advancement. transformation initiative. To successfully navigate the challenges posed by the evolving digital landscape, it is necessary to foster a skilled workforce proficient in cloud technologies. 4.2 NAVIGATING THE CHALLENGES AHEAD According to a 2022 report by MCIT, the KSA will need to employ around 1.2 million ICT professionals by While this case study on the KSA offers valuable lessons 2030. Current estimates suggest that the country will and takeaways, it is important to acknowledge that the have a shortfall of 300,000 digitally skilled workers country’s journey toward the full development of the by then, unless immediate action is taken to address cloud computing sector is still in its early stages, and this skills gap.60 several challenges lie ahead. As other countries seek to achieve similar progress, they should also ensure that While KSA boasts a young and technologically savvy robust strategies are in place to effectively navigate workforce, this proficiency does not always align with the same challenges encountered by the KSA. Key the specific skills and experiences needed to meet challenges are outlined in this section. the burgeoning demands for cloud migration and management across enterprises. To address this gap, 4.2.1 CLOSING THE DIGITAL SKILLS GAP KSA needs to prioritize and scale up its investment in training programs, certifications, and educational The cloud skills gap presents a major challenge programs tailored to the needs of the cloud industry. for governments and businesses worldwide. Furthermore, there is an opportunity to foster greater Despite soaring demand for cloud experts, supply gender diversity in this field, especially considering remains insufficient. According to a report,58 95% of that women’s representation in the workforce remains businesses globally are grappling with a shortage disproportionately low in many developing countries. of cloud and IT skills, leading to delays in digital In KSA, women often have high levels of education but transformation projects. As a result, one-third of low level of participation in the workforce, making it these businesses anticipate a substantial impact essential to create avenues for their inclusion and on their financial objectives. In the U.S., over 85% of advancement in the rapidly evolving technology sector.61 surveyed IT decision-makers are concerned that the 58 The Cloud Skills Gap in 2023. https://www.softwareone.com/en-us/blog/articles/2023/11/13/cloud-skills-gap-in-2023 59 Skills Gap in Cloud Operations, US 2023, Statistica. https://www.statista.com/statistics/1418807/cloud-operations-skill-gap-impact-business-us/ 60 MCIT 2021 Annual Report. 2022 61 Mckinsey & Company, Rima Assi and Chiara Marcati, Women at Work in the Middle East, March 6, 2020 39 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 4. KEY TAKEAWAYS AND CHALLENGES AHEAD 4.2.2 ADDRESSING DATA LOCALIZATION These relatively strict data localization requirements REQUIREMENTS may constrain organizations’ capacity to access, share, and re-use data across national borders.64 Facilitating cross-border data flow, including that of personal data, is essential for driving economic This limitation has the potential to restrict the growth and innovation. Cross-border data flow not only flow of information, hinder the scalability of data- enables the emergence of new and scalable business driven services, and impact the global operations of models, but also provides micro, small and medium- businesses.65 Moreover, these requirements may result size enterprises with access to vastly broader markets. in elevated costs for businesses, as they may need to A study spanning Brazil, China, the European Union, invest in local data storage and processing facilities. India, Indonesia, Korea, and Vietnam has shown that Additionally, they may curtail businesses’ ability to data localization62 laws incur significant economic cost, capitalize on global cloud services, thereby impacting ranging from 0.7% to 1.1% of GDP.63 their competitiveness and capacity for innovation. One key challenge posed by KSA’s data localization Overall, the data localization rule presents both rule is the strict requirement for data controllers to opportunities and challenges for businesses in Saudi store and process personal data within the country. Arabia. While compliance may require significant This requirement can impede cross-border data flows. investment and resources, it could also contribute to The CST’s Cloud Computing Services Provisioning the growth of the local technology sector. However, Regulations (CCRF), which regulates all cloud services in it remains to be seen whether the benefits of the the KSA, sets out the service provider’s obligations and regulation outweigh the potential economic impact.66 mandates that cloud service providers registered with the CST (and their cloud subscribers) are prohibited 4.2.3 ADDRESSING THE ENERGY EFFICIENCY from transferring any content/data from the KSA OF DATA CENTRES Government (regardless of data classification) outside the country for any purpose (for activities such as data Data centers, which are pivotal digital services, caching, backup, or similar purposes), even temporarily, contribute significantly to global greenhouse gas unless permitted by the local laws or regulations. This (GHG) emissions. According to the International Energy requirement applies to both CSPs and service users/ Agency (IEA), data centers and data transmission subscribers. In the case of non-government data, CSPs networks account for 1% to 1.5% of global electricity are required to obtain prior consent from users before consumption. 67 Given the accelerated pace of transferring, storing, or processing their data outside digitalization and the increasing use of technologies of the country, whether permanently or temporarily. like AI, the Internet-of-Things (IoT), cloud computing, 62 Data localization is the practice of limiting the processing and storage of data within a specific local jurisdiction. 63 Bauer, Matthias, Hosuk Lee-Makiyama, Erik van der Marel, and Bert Verschelde. 2014. The Costs of Data Localization: Friendly Fire on Economic Recovery. Brussels: European Center for International Political Economy. 64 https://www.trade.gov/knowledge-product/saudi-arabia-market-challenges 65 Global Data Alliance, https://globaldataalliance.org/wp-content/uploads/2022/09/09082022gdaksapdp.pdf 66 Localization and the Saudi Arabian Cloud Computing Regulatory Framework Version 3.0 https://www.linkedin.com/pulse/data-localization-saudi-arabian-cloud-computing-30-saud-a-aldawsari/ 67 https://www.iea.org/energy-system/buildings/data-centres-and-data-transmission-networks THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 40 4. KEY TAKEAWAYS AND CHALLENGES AHEAD BOX 4.2: Intentional Data Center Greening Efforts and Policies Enacted in KSA. To be sustainable, data centers must follow green building and green data center standards and adopt innovative technologies. Furthermore, several companies in KSA are already moving toward greener data centers. One example is the Saudi Telecom Company (STC), which announced its plan to build eco-friendly data centers, powered by renewable energy and designed to minimize carbon emissions. STC’s goal is to reduce its environmental footprint by investing in innovative technologies and sustainable solutions. SADAIA is following suit, using AI to optimize energy usage. SDAIA actively supports sustainability practices by using AI to achieve between 5% and 10% of Saudi Arabia’s ambitious 2030 carbon neutrality goal. The plan is to develop AI-powered, integrated solutions for predicting environmental phenomena, monitoring emissions, and optimizing energy use. Overall, data centers in KSA have immense potential to support the clean energy transition and help to build a more sustainable future. With the right investments in technology and infrastructure, they can be transformed from energy-intensive consumers to energy providers, driving the transition to a more sustainable energy future. In addition, the Saudi government has launched several initiatives to encourage the development of renewable energy in the country. and big data, it is imperative for countries to prioritize development of the Special Economic Zones (SEZs), emissions reduction for their rapidly expanding ICT Free Trade Zones (FTZs), and smart city initiatives, will infrastructures. Given their high energy consumption, further bolster the data center market. Saudi Arabia is the greening of data centers is crucial for a sustainable the second-largest data center market in the Middle digital transformation. It also supports climate change East region, which provides an opportunity to the KSA mitigation and adaptation efforts. By reducing the government to establish green building standards, environmental footprint of data centers, countries implement energy efficiency regulations for data can lower emissions and align with sustainability centers, incentivize the adoption of renewable energy goals. Currently, there are an estimated 24 operational sources, regulate refrigerant usage, and promote colocation data centers68 in the KSA (colocation data efficient e-waste management practices. Prioritizing the centers are those where business rent data center development of green and energy-efficient data centers infrastructure from a third party). The data center is imperative as the KSA strives to position itself as a market is anticipated to continue its growth trajectory, hub of technology and innovation, anchored by cloud with investments expected to reach $3.18 billion by technology and the burgeoning growth of data centers. 2029. The rapid pace of digitalization, along with the 68 Arizton Advisory & Intelligence, Saudi Arabia Data Center Market 2024-2029, https://www.arizton.com/market-reports/saudi-arabia-data-center- market-investment-analysis 69 https://sustainability.stc.com.sa/cdn/SustainabilityReport-2022-en.pdf 70 https://sdaia.gov.sa/en/MediaCenter/News/Pages/NewsDetails.aspx?NewsID=283 41 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 4. KEY TAKEAWAYS AND CHALLENGES AHEAD 4.2.4 ESTABLISHING CENTRALIZED PROCUREMENT The procurement of cloud services, being a new area, is a challenge to established centralized procurement authorities. The Government Cloud Office and the Office of Government Procurement at the Ministry of Finance have been collaborating on setting best practices and guidelines for procurement of various cloud- based services (IaaS, PaaS, SaaS), as well as standard service level agreements that would satisfy the public sector client’s requirements, depending on the type of service moved to the cloud. This topic is the subject of a future research project, as more evidence and data are collected on the subject. In conclusion, even for governments leading the transition to the cloud, the journey is not finished. Looking ahead, KSA’s cloud ecosystem is still poised for significant transformation over the next several decades. Given the government’s ambition and investments from cloud providers, KSA is well- positioned to develop a mature and competitive cloud environment, characterized by a broad set of offerings, healthy competition, a strong user base, and an attentive focus on building cloud skills and capabilities. THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 42 5 CONCLUSIONS The Kingdom of Saudi Arabia’s journey in developing its cloud computing infrastructure and adopting cloud services in the government and private companies offers valuable insights and lessons for other countries, particularly those in the developing world, as they embark on their own digital transformation initiatives. KSA’s experience demonstrates that cloud competences and skills are a leading factor in the ability to leverage cloud technologies. With a strong understanding of cloud, governments can establish a well-defined cloud vision, robust cloud strategies, and effective execution. These are the crucial activities for the successful development and adoption of cloud computing. The top-down approach adopted by the KSA KSA’s Cloud First Policy, along with the Cloud government, starting with Vision 2030 and cascading Computing Services Provisioning Regulations and down to specific strategies, legislation, regulations, the Guideline for Cloud Adoption, provides a clear policies, and guidelines, has been instrumental mandate for government entities to prioritize in enabling the country’s digital transformation cloud solutions and a framework to navigate the agenda. This approach ensures alignment between complexities of cloud adoption. These measures have national aspirations and the implementation of been critical in accelerating the adoption of cloud cloud computing initiatives, fostering a conducive services within the public sector, setting an example environment for innovation and growth. that the private sector can follow. Looking ahead, 43 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 5. CONCLUSIONS the cloud computing landscape in KSA is poised for As other countries seek to emulate KSA’s progress in significant transformation over the next five years. cloud adoption, they must first be prepared to develop Together, the government’s ambition and investments their cloud competences and to adapt and tailor their from cloud providers mean that KSA is well-positioned strategies to their unique contexts and challenges. to develop a mature and competitive cloud ecosystem, While KSA’s experience offers valuable lessons, each characterized by a broad set of offerings and healthy country must chart its own course based on its specific competition among providers. needs, resources, and constraints. The KSA government’s proactive collaboration In conclusion, KSA’s journey in cloud adoption with industry partners, both local and global, has demonstrates that, with a clear vision, strategic been another key factor in the development of the planning, and effective execution, developing country’s cloud computing ecosystem. By partnering countries can harness the power of cloud computing with leading cloud service providers and investing to accelerate their digital transformation and build in the adoption of cloud by local businesses, KSA more agile, data-driven, and citizen-centric digital has positioned itself as an attractive destination for public infrastructure and government services. As cloud-related investments. However, as KSA continues the global community continues to grapple with the its journey towards becoming a cloud-first nation, it challenges of digital transformation, KSA’s experience must also navigate the challenges that lie ahead, with offers valuable insights and inspiration for those a laser sharp focus on closing the digital skills gap, seeking to leverage the potential of cloud computing while increasing data centers’ effective consumption for inclusive and sustainable development. of renewable energy. THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 44 REFERENCES Balakrishnan, T., Gnanasambandam, C., Santos, L., & Srivathsan, B. (2021). Cloud-migration opportunity: Business value grows, but missteps abound. Carugati, A., Hadzilias, E., & Demoulin, N. (2005). Setting the framework for developing eGovernment services on cultural heritage. ECIS 2005 Proceedings, 132. González-Martínez, J. A., Bote-Lorenzo, M. L., Gómez-Sánchez, E., & Cano-Parra, R. (2015). Cloud computing and education: A state-of-the-art survey. Computers & Education, 80, 132-151. Goundar, S. (2010). Cloud computing: Opportunities and issues for developing countries. DiploFoundation: Internet governance research paper. Kuyucu, A. D. H. (2011). Exploring policy-formulation for SMEs in cloud computing: The case of Turkey. IBIMA Business Review. Jaeger, P. T., Lin, J., & Grimes, J. M. (2008). Cloud computing and information policy: Computing in a policy cloud? Journal of Information Technology & Politics, 5(3), 269-283. Lian, J. W., Yen, D. C., & Wang, Y. T. (2014). An exploratory study to understand the critical factors affecting the decision to adopt cloud computing in Taiwan hospital. International Journal of Information Management, 34(1), 28-36. Liang, Y., Qi, G., Wei, K., & Chen, J. (2017). Exploring the determinant and influence mechanism of e-Government cloud adoption in government agencies in China. Government information quarterly, 34(3), 481-495. Melhem, S. Kim & Accenture: Cloud Computing Toolkit: Country Assessment Models and Guidelines – The World Bank, 2016 Polyviou, A., & Pouloudi, N. (2015, January). Understanding cloud adoption decisions in the public sector. In 2015 48th Hawaii International Conference on System Sciences (pp. 2085-2094). IEEE. Sultan, N. (2014). Making use of cloud computing for healthcare provision: Opportunities and challenges. International Journal of Information Management, 34(2), 177-184. Wahsh, M. A., & Dhillon, J. S. (2015, December). An investigation of factors affecting the adoption of cloud computing for E-government implementation. In 2015 IEEE Student Conference on Research and Development (SCOReD) (pp. 323-328). IEE   45 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA APPENDIX A Evaluating an organization’s cloud readiness is a critical component of the digital transformation journey, especially for public sector entities. Cloud readiness assessment tools are designed to measure an organization’s current status across various domains including governance, technology, people, and processes. These tools help identify strengths and weaknesses, providing a clear picture of what needs to be improved or leveraged to ensure a successful transition to the cloud. They are used to evaluate aspects like security compliance, data management capabilities, technical infrastructure, and staff readiness. The insights gained from these assessments guide strategic planning, decision-making, and prioritization of investments in cloud technologies. However, while these tools offer valuable guidance, they have limitations. They often provide a snapshot in time and may not capture evolving dynamics or future challenges. Organizations must therefore use these tools as part of an ongoing process of assessment and adaptation. Among the different tools available, three stand out for their relevance and utility in the public sector: 1. World Bank Cloud Readiness Toolkit: The World Bank’s Cloud Readiness Toolkit is specifically designed to assist governments and public sector organizations in assessing their readiness for cloud adoption. This toolkit provides recommendations and guidance tailored to the unique needs and circumstances of public sector entities, helping them to plan and implement their cloud migration strategies effectively. 2. Amazon Web Services’ (AWS) Cloud Adoption Readiness Tool (CART): CART helps organizations, including those in the public sector, assess their preparedness for cloud migration. It uses a self-guided checklist to gauge the organization’s current state and provides a detailed report with recommendations for improvement. 3. Accenture’s Fit-for-Cloud Assessment Tool: This tool is designed to quickly determine cloud fitness and portfolio health for government decision-makers. This tool offers directional and actionable insights, essential for guiding the initial steps towards cloud adoption and digital transformation. It enables different agencies to evaluate their readiness for cloud migration, providing a foundation for developing a strategic roadmap tailored to their unique requirements and regulatory landscape. Its original version was elaborated for the World Bank Digital Development team under a grant from the Korean Government. THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 46 APPENDIX B: DGA ORGANIZATIONAL CHART Board of Directors BoD General Secretariat Nomination and Remuneration Executive Committee Committee Governor Strategic Committee Audit Committee Internal Audit Governor's O ce Executive O ce Legal A airs Innovation and Emerging Technologies Administrative Shared Human Financial Procurement A airs Services Resources A airs and Facilities Technology Implementation Data and Technology & Technology Products & Infrastructure and Enablement Business Solutions Architecture Services and Operations (IT PMO) Intelligence Strategy and Partnerships & Strategy & Projects & Indicators and Institutional International Partnerships Initiatives Competitiveness Performance Cooperation Marketing & Beneficiaries Digital Communication Marketing Communication Engagement Media Channels Risks & Data Business Business Governance Risks Cybersecurity Governance Continuity Continuity O ce Regulation & Maturity and Digital Trust Regulatory Regulation Licenses Digital Trust Compliance and ID Consultations Investment & Information Government Investment Financial Digital Government Government & Reporting Cloud O ce Planning Procurement Excellence Excellence Business User Business & Products and Products and Products and Architecture Experience Government Digital Solutions Solutions Solutions - Relations and Service and Quality Transformation -Government -Business Individuals Design Management Sector Center General Department Department 47 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA 48 49 THE CLOUD IMPERATIVE: STRATEGY AND PRACTICES FROM THE KINGDOM OF SAUDI ARABIA