CST CRF Compliance Levels Explained (CL1, CL2, CL3)
CST CRF compliance levels are the risk-based tiers in the Communications, Space & Technology Commission's Cybersecurity Regulatory Framework (CRF) for ICT service providers. In published secondary summaries aligned to CST's CRF, the levels are commonly labelled CL1, CL2 and CL3: basic controls, advanced requirements, then efficiency monitoring and continuous improvement of the controls established at the lower levels. Exact applicability of which level applies to your licence or service model is confirmed against current CST guidance on discovery - not guessed from marketing pages.
Start with a scoped gap assessment
If you are a CST-licensed or registered telecom, hosting, cloud, connectivity or related ICT provider preparing for self-assessment or independent assessment, start with a scoped gap assessment, then remediate with owners and evidence. Service page: CST CRF consulting.
Guide highlights
- CL1 / CL2 / CL3 in plain language
- Six CRF domains
- How to move up a level
- Evidence themes assessors sample
What the CST CRF is
The Cybersecurity Regulatory Framework (CRF) sets cybersecurity expectations for service providers under CST's regulatory scope in Saudi Arabia. CST established the CRF to raise cybersecurity maturity in the ICT sector for organisations licensed or registered by CST (and others CST brings into scope). Official CST regulation pages and CRF publications define the current edition, domains and assessment expectations - treat those as authoritative.
In plain terms: if you provide regulated ICT, telecom, hosting or related services in the Kingdom, CRF is the cybersecurity programme you are expected to operate with evidence, not a one-time policy pack.
Verified level structure: CL1, CL2, CL3
| Level | Common label | What it generally means |
|---|---|---|
| Level 1 | CL1 | Basic security controls - foundational capabilities you must have in place |
| Level 2 | CL2 | Advanced requirements - deeper control depth and evidence expectation |
| Level 3 | CL3 | Requirements focused on efficiency monitoring and continuous improvement of the controls established at Levels 1 and 2 |
- Levels are progressive. CL3 is not a separate random checklist; it assumes CL1/CL2 controls exist and are being measured and improved.
- Which CL applies to you depends on CST licensing, service model, risk profile and current CST assignment/guidance - confirm on discovery. Do not self-award CL3 for marketing.
- Higher levels often bring stricter assessment expectations (including independent third-party assessment where CST rules require it for your level). CyberInTech supports readiness and remediation; we do not claim by default to be your mandated independent auditor.
Domains the levels apply across
CST CRF is commonly described as spanning six main domains (control counts appear in CST's published framework - use the official PDF for exact figures rather than memorised marketing numbers):
Cybersecurity Governance
Roles, policies and oversight for the CRF programme.
Asset Management
Inventory and ownership of assets in scope.
Cybersecurity Risk Management
Identify, treat and track cyber risks.
Logical Security
Access, hardening and related technical controls.
Physical Security
Facility and physical access protections where relevant.
Third-Party Security
Suppliers and partners with system or data access.
Your applicable CL determines which controls in those domains you must implement and evidence. A hosting provider's third-party and physical evidence pack often looks different from a pure connectivity provider's - scope the service model first.
Who must work to a CRF compliance level?
Telecom and ICT
Providers under CST licensing or registration.
Hosting and cloud
Colocation and related providers serving Saudi customers.
Managed service / connectivity
Providers answering CST or partner cybersecurity asks.
Assessment teams
Preparing for CRF self-assessment, evidence packaging, or remediation after review.
CNI entities may also face NCA ECC (and related NCA control sets). CRF and ECC are not interchangeable labels - map overlaps rather than assuming one satisfies the other. See NCA ECC.
How to move from CL1 toward CL2 and CL3
Confirm your assigned or expected level
Gather licence/registration type, services offered, any CST communication naming a compliance level, and upcoming assessment deadlines. If unclear, treat discovery as the moment to align expectations with counsel and current CST text.
Gap assessment against the applicable CL
Assess control-by-control across the six domains for your level. Distinguish: missing control, designed but not operated, operated but not evidenced, evidenced but not monitored (especially relevant as you approach CL3). Start: gap assessment.
Close foundational (CL1) gaps first
Basic governance, asset inventory, risk process, logical access, physical protections and third-party minimums usually need to be real before advanced and continuous-improvement layers make sense.
Deepen for CL2
Advanced requirements typically demand richer control design, broader coverage, and stronger evidence. Expect more sampling on logical security, monitoring, change and supplier chains.
Operationalise CL3 (monitor and improve)
CL3 focuses on efficiency monitoring and continuous improvement of L1/L2 controls - metrics, reviews, corrective actions, and management reporting. If lower-level controls do not operate, CL3 language is empty.
Assessment readiness
Prepare self-assessment inputs and, where required, evidence for independent assessment. Keep an evidence index: policies, configs, tickets, test results, supplier assurances, physical access logs, training records.
CL1 vs CL2 vs CL3 - buyer checklist
Use this as a conversation guide with leadership (still confirm against CST's current text):
CL1 - basic
Named governance roles; assets inventoried and owned; risk process live; logical access controlled; physical protections where relevant; third parties identified and controlled at a basic level; evidence shows controls operate.
CL2 - advanced
Deeper coverage and stricter evidence across the same six domains; stronger operational discipline; fewer exceptions without owners; ready for more demanding sampling.
CL3 - monitor and improve
Metrics show how efficiently L1/L2 controls perform; periodic review drives corrective action; management reporting ties cybersecurity performance to service risk; continuous improvement is evidenced.
Evidence pack themes assessors actually sample
- Governance: charter, RACI, approved policies, meeting minutes
- Assets: inventory extracts, ownership fields, classification
- Risk: register, treatment decisions, residual risk acceptance
- Logical: IAM configs, MFA evidence, privileged access logs, periodic reviews
- Physical: access control lists, visitor logs, CCTV retention policy where relevant
- Third parties: contracts/security schedules, due-diligence records, access removals
Pair each artefact with a control ID from the CRF edition in scope so self-assessment and independent assessment move faster.
Relationship to NCA ECC and customer questionnaires
Many CST providers serve government or financial customers who ask for NCA ECC or SAMA-aligned evidence in questionnaires. Running CRF and ECC as two disconnected projects doubles cost. On discovery we can map overlapping governance, IAM, logging and supplier themes while keeping regulator-specific wording intact - see NCA ECC and SAMA CSF.
Hosting and cloud models should pay special attention to CRF third-party and physical/logical expectations and any NCA cloud-related controls that customer contracts invoke.
Deliverables you should expect from a CRF levels engagement
- CRF gap register mapped to domains/controls and applicable CL
- Prioritised remediation roadmap with owners
- Governance/policy/control artefacts as scoped
- Evidence checklist for self-assessment or independent-assessment readiness
- Clear open technical and process actions
Common mistakes on CRF compliance levels
- Guessing CL without CST confirmation
- Policies without evidence - assessors sample operation
- Jumping to CL3 metrics before CL1/CL2 controls exist
- Ignoring third-party and hosting chains - often where CRF bites
- Assuming ISO 27001 equals CRF - overlap yes; equivalence no
- Claiming independent-auditor status incorrectly - readiness support is not the mandated auditor role
- Buying tools before gap assessment
How CyberInTech helps
We scope your CST service model and applicable level, assess against CRF domains, and support governance, technology mapping, remediation and evidence packaging with your team. Where independent assessment is required, we help you prepare - we say plainly if we are not the mandated independent auditor for that step. Details: CST CRF consulting.
We are not a regulator, not a certification body, and we do not claim "approved/accredited consultant" status by default.
FAQ
What are CL1, CL2 and CL3 in CST CRF?
They are the three compliance levels commonly used in the CRF: CL1 basic controls, CL2 advanced requirements, CL3 efficiency monitoring and continuous improvement of L1/L2 controls. Confirm which level applies to you against current CST guidance.
Who decides which compliance level we must meet?
CST licensing, service model, risk factors and current CST rules/assignments drive applicability. CyberInTech helps you interpret and evidence against the level that applies - we do not invent your level for marketing.
Do we need an independent auditor?
It depends on your applicable compliance level and current CST requirements. Where independent third-party assessment is required, we support preparation and remediation; we do not claim that auditor role unless separately and correctly engaged.
Should we complete a gap assessment before self-assessment?
Yes, in most cases. A gap assessment shows weak domains and missing evidence before you face formal self-assessment or independent review.
How many domains does CRF cover?
CRF is commonly structured around six main domains: Cybersecurity Governance, Asset Management, Cybersecurity Risk Management, Logical Security, Physical Security, and Third-Party Security. Use CST's current publication for exact control lists and counts.
Can CRF work align with NCA ECC or ISO 27001?
Yes where those also apply. Map overlaps to reduce duplicate remediation; do not assume one framework satisfies the other.
How long does moving up a compliance level take?
It depends on starting maturity, service complexity and whether technology uplift is included. Many providers phase work over months after an initial gap assessment. Timeline confirmed after discovery - no fake guarantees.
How much does CST CRF consulting cost?
Fees are scoped on discovery. We do not publish invented price lists.
Related pages
Next step
Tell us your CST licence/registration type, service model, any CL you already know, and whether a self-assessment or independent assessment deadline is approaching. Our Riyadh team will outline a practical plan - fees scoped on discovery. Call +966 531 446 716 or email info@cyberintech.com.
Contact CyberInTech