Sharing Indicator : White Essential Cybersecurity Controls In line with related and applicable laws and regulations, and in addition to the applicable ECC controls from main domains (1), (2), (3) and subdomain (4-1), the cybersecurity requirements related to the use of hosting and cloud computing services must include at least the following: 4-2-3 4-2-4 28 4-2-3-1 Classification of data prior to hosting on cloud or hosting services and returning data (in a usable format) upon service completion. 4-2-3-2 Separation of organization’s environments (specifically virtual servers) from other environments hosted at the cloud service provider. 4-2-3-3 Organization’s information hosting and storage must be inside the Kingdom of Saudi Arabia. The cybersecurity requirements related to the use of hosting and cloud computing services must be reviewed periodically. Document Classification: Unclassified