Governance

Cloud Service Provider (CSP)

Any entity that provides cloud services and may control local cloud infrastructure.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Pakistan	Pakistan Cloud First Policy	In Force	This definition narrows CSPs to those meeting MoITT's accreditation/registration criteria and security baselines for inclusion on a pre-accredited supplier list used in PSE procurement.
Saudi Arabia	Cloud Computing Regulatory Framework (CCRF) — Version 3	Superseded	This definition widens CSPs to any natural or legal person providing IaaS, PaaS, or SaaS, adding specific rules for those exercising direct or effective control over data centres or critical cloud infrastructure in the Kingdom, including registration and conformance duties.

What it triggers

Under the Saudi Arabia Cloud Computing Regulatory Framework (CCRF) Version 3, which was superseded, CSPs had registration and conformance duties where they exercised direct or effective control over data centres or critical cloud infrastructure hosted or used in the Kingdom.source

Definitions (2)

A natural or legal person that provides cloud services (IaaS, PaaS, SaaS); the definition includes specific rules and obligations where a CSP exercises direct or effective control over data centres or critical cloud infrastructure hosted or used in the Kingdom, including registration and conformance duties.

Cloud Computing Regulatory Framework (CCRF) — Version 3 (Communication and Information Technology Commission)Definition 1 of 2

A CSP is any entity that provides infrastructure, platform, or software cloud services and which must meet the MoITT's accreditation/registration criteria and security baselines to be included on the pre-accredited supplier list used for PSE procurement.

Pakistan Cloud First PolicyDefinition 2 of 2

Not to be confused with

Service Provider

Service Provider refers broadly to entities providing digital, networked or platform services, while CSP specifically targets those providing cloud services like IaaS, PaaS, or SaaS with added regulatory criteria.

fournisseurs de services d'informatique en nuage

Fournisseurs de services d'informatique en nuage describes cloud service providers offering computing and storage services in general terms, whereas these CSP definitions add specific accreditation, control, or registration obligations.

Questions and answers

What obligations did CSPs have under Saudi Arabia's CCRF Version 3?

CSPs were defined as natural or legal persons providing cloud services including IaaS, PaaS, SaaS. Those exercising direct or effective control over data centres or critical cloud infrastructure in the Kingdom had registration and conformance duties. The framework was superseded.

How do these CSP definitions differ in scope for compliance?

Pakistan's definition limits CSPs to accredited providers for public procurement. Saudi Arabia's superseded definition covers any provider with added duties for infrastructure control in the Kingdom.