ZTABS delivers cloud services for Riyadh enterprises — NDMO and NCA-compliant cloud migrations to AWS Middle East (Bahrain), Azure UAE, and the upcoming Saudi cloud regions, infrastructure modernization for Vision 2030 digital transformation, and managed cloud operations for organizations moving from on-premises datacenters.
Saudi Arabia is in the middle of the largest cloud migration in Middle Eastern history, driven by Vision 2030's mandate to digitize government and enterprise operations. The National Data Management Office (NDMO) issued the Cloud First Policy in 2022, directing government entities to adopt cloud as the default for new IT projects. The National Cybersecurity Authority (NCA) published cloud security controls (CCC-1:2020) that define the security baseline for cloud adoption across both government and critical infrastructure sectors. CITC (Communications, Information & Technology Commission) regulates telecommunications and data center operations. Together, these create a regulatory framework that simultaneously encourages cloud adoption and constrains how it is done. Saudi data classification (issued by NDMO) categorizes data into four levels — public, restricted, confidential, and top secret — with specific cloud deployment rules per level. Public and restricted data can be hosted on international public cloud. Confidential data requires cloud providers with Saudi presence and specific security controls. Top secret data must remain in government-operated infrastructure. This classification directly determines cloud architecture decisions. The cloud provider landscape in Saudi Arabia is evolving rapidly. AWS launched its Middle East (Bahrain) region in 2019 and announced plans for a Saudi Arabia region. Microsoft Azure has UAE North (Dubai) and announced Azure Saudi Arabia. Oracle opened a cloud region in Jeddah (Saudi Arabia West) in 2022. Google Cloud operates from Doha and Dammam (Saudi Arabia East). Alibaba Cloud has a Saudi presence. STC Cloud, the local hyperscaler, offers Saudi-sovereign cloud infrastructure. For Riyadh enterprises, cloud migration is not optional — it is a competitive necessity. Government contracts increasingly require cloud-based delivery. Saudi talent expects modern cloud-based tooling. And the cost of maintaining aging on-premises infrastructure in a country experiencing 40-50°C summers (with associated cooling costs) makes cloud economics increasingly favorable.
Riyadh cloud demand spans government digitization, enterprise transformation, oil and gas modernization, and the startup ecosystem. Government cloud: Saudi government entities are migrating to cloud under NDMO's Cloud First Policy. Government cloud requirements: NDMO data classification compliance (each dataset classified and routed to an appropriate cloud tier), NCA cloud security controls (CCC-1:2020 — 114 security controls spanning governance, identity, data protection, network security, and incident management), interoperability (government systems must integrate through the government integration platform — Takamul), and Arabic-first interfaces (government applications serve Saudi citizens in Arabic). The government cloud market includes: ministry digital transformation (converting paper-based processes to cloud-hosted digital services), municipal services (smart city platforms for Riyadh, NEOM, and other giga-projects), healthcare digitization (Sehhaty national health platform, hospital information systems moving to cloud), and education technology (university learning management, K-12 digital platforms). Enterprise cloud: Saudi enterprises (banking, telecom, retail, manufacturing) are migrating from on-premises datacenters. The drivers: reducing capital expenditure on hardware refresh cycles, enabling remote and hybrid work (accelerated by COVID but sustained by Saudi companies adopting modern work models), scaling for seasonal demand (Hajj and Umrah create extreme seasonal spikes for hospitality, transport, and retail), and accessing cloud-native services (AI/ML, big data analytics, IoT platforms) that cannot be replicated on-premises. Oil and gas: Saudi Aramco (the world's largest oil company) and the petrochemical sector are modernizing technology infrastructure. Oil and gas cloud needs: SCADA and industrial control data processing (moving from isolated industrial networks to cloud-connected analytics while maintaining OT security), reservoir modeling and simulation (computationally intensive workloads that benefit from cloud elasticity — run for days during analysis, then release capacity), digital twin platforms (virtual models of refineries and processing plants for operational optimization), and HSE (Health, Safety, Environment) data management. Startups and SMEs: Saudi startups are cloud-native from birth. Their cloud needs: right-sized infrastructure (avoiding overprovisioning that burns through seed funding), DevOps automation (CI/CD pipelines, monitoring, alerting — the cloud operations maturity that enterprise clients expect during sales due diligence), and managed services (startups cannot afford dedicated cloud engineers — they need managed cloud operations that handle scaling, security, and cost optimization).
Our Riyadh cloud services cover migration, modernization, and ongoing management with NCA/NDMO compliance integrated throughout. Cloud migration methodology: (1) Assessment: we assess the existing infrastructure — applications, databases, integrations, dependencies — and classify each workload against NDMO data classification. The assessment produces: a workload inventory (every application, its dependencies, its data classification, and its cloud suitability), a migration strategy per workload (rehost — lift and shift for applications that work unchanged on cloud; replatform — minor modifications for cloud optimization; refactor — rewrite for cloud-native architecture; or retain — stay on-premises for specific regulatory or technical reasons), a target architecture (which cloud provider, which region, which services — mapped to data classification requirements), and a migration sequence (which workloads migrate first — typically starting with development/test environments, then non-critical production, then critical systems). (2) NCA compliance implementation: before migrating any workload, we implement the NCA Cloud Computing Cybersecurity Controls (CCC-1:2020) applicable to the cloud deployment. The 114 controls cover: governance and risk management (cloud security policy, risk assessment, third-party risk management), identity and access management (privileged access management, MFA, SSO integration with the organization's identity provider), data protection (encryption at rest and in transit, key management — using the cloud provider's KMS or a dedicated HSM for high-sensitivity data), network security (virtual network segmentation, firewall rules, DDoS protection, VPN connectivity to on-premises), and logging and monitoring (security event logging, SIEM integration, incident response procedures). (3) Migration execution: we execute migrations in waves — typically 3-6 workloads per wave, with validation between waves. Each migration includes: pre-migration testing (the application is deployed on cloud in parallel with the existing deployment, tested with realistic data, and validated for functionality, performance, and security), cutover planning (a documented cutover plan specifying: sequence of steps, responsible persons, rollback triggers, and communication plan), cutover execution (typically during a weekend maintenance window — DNS switchover, data synchronization verification, and health check validation), and post-migration monitoring (intensive monitoring for 2 weeks after migration — performance baselines, error rate tracking, and user experience validation). Cloud optimization: (1) Cost management: Saudi organizations frequently overspend on cloud by 30-50% due to: over-provisioned instances (sized for peak load and never adjusted), unused resources (instances and storage left running after projects end), lack of reserved instance commitments (paying on-demand rates for predictable workloads), and unoptimized storage (data stored on premium SSD when standard storage would suffice). We implement: real-time cost dashboards (spending by service, by department, by project — visible to finance and IT), automated rightsizing recommendations (identifying instances that consistently use less than 40% of allocated capacity), reserved instance and savings plan optimization (committing to baseline usage at 25-40% discount), and resource lifecycle management (automated shutdown of development environments outside working hours, cleanup of orphaned resources). (2) Performance optimization: cloud performance tuning for Saudi workloads including: CDN configuration (serving Saudi users from the nearest edge location — reducing latency for web applications), database optimization (query performance analysis, index tuning, read replica configuration for read-heavy workloads), and autoscaling configuration (handling the extreme seasonal patterns of Saudi business — Ramadan traffic surges, government fiscal year-end spikes, Hajj/Umrah seasonal peaks).
Government / Public Sector
A Saudi government entity responsible for licensing and regulatory compliance operated 28 applications on aging on-premises infrastructure — 3 physical servers approaching end of life (7+ years old, no vendor support), 12 virtual machines on an overloaded VMware cluster, and an Oracle database server running near capacity. The problems: (1) Reliability: the infrastructure experienced 4 unplanned outages in the previous 12 months, each lasting 4-8 hours. The entity processed 2,000+ licensing applications daily — each outage hour represented 80+ applications delayed. (2) Performance: the licensing application portal (citizen-facing) had page load times of 8-12 seconds during peak hours (9-11 AM and 1-3 PM) — applicants abandoned the process and called the contact center, creating 15,000+ monthly calls that should have been online transactions. (3) NDMO compliance: the Cloud First Policy directed the entity to migrate to cloud. The entity needed to demonstrate compliance during the upcoming NDMO digital maturity assessment. (4) Security: the NCA conducted a cybersecurity assessment and identified 31 findings — many related to the aging infrastructure (unpatched systems, lack of network segmentation, insufficient logging). (5) Disaster recovery: the entity had no DR capability. All infrastructure was in a single building. The entity's risk officer had flagged this annually for 3 years without resolution.
We migrated the entity to cloud over 20 weeks: (1) Data classification: every application and dataset classified per NDMO framework. Result: 22 applications contained restricted data (suitable for public cloud with security controls), 4 applications contained confidential data (requiring specific cloud security measures), and 2 applications contained highly sensitive data (retained on government infrastructure with cloud-based DR). (2) Target architecture: AWS Middle East (Bahrain) as the primary cloud platform — selected for: proximity to Saudi Arabia (low latency), Arabic language support in the management console, and compliance with NDMO cloud requirements. Multi-AZ deployment for high availability. VPN connectivity from the cloud to the entity's retained on-premises systems for the 2 highly sensitive applications. (3) NCA compliance: implemented all applicable CCC-1:2020 controls before migration: AWS IAM with MFA and SSO (integrated with the entity's Active Directory), AWS KMS for encryption key management (all data encrypted at rest and in transit), VPC network segmentation (each application in its own subnet with security groups enforcing least-privilege access), AWS CloudTrail and CloudWatch for comprehensive logging (feeding into the entity's SIEM), and AWS WAF and Shield for the citizen-facing portal (DDoS protection and web application firewall). (4) Citizen portal modernization: during migration, we replatformed the licensing portal from a monolithic Java application to a containerized architecture on ECS Fargate. The portal was optimized: database queries rewritten (the top 5 slow queries causing 80% of performance problems were identified and optimized), caching layer added (ElastiCache for frequently-accessed reference data — license categories, fee schedules — reducing database load by 60%), CDN deployment (CloudFront serving static assets from Saudi edge locations — reducing page load from 8-12 seconds to under 2 seconds), and autoscaling configured (the portal scales from 2 to 20 containers during peak hours, scaling back during off-peak — handling the 9-11 AM rush without performance degradation). (5) Disaster recovery: the cloud architecture inherently provides multi-AZ redundancy. For the 2 retained on-premises applications, we implemented cloud-based DR: database replication to RDS in the cloud (continuous replication with less than 1-minute lag), application standby on EC2 (warm standby — running but not receiving traffic), and automated failover (Route 53 health checks trigger DNS failover within 5 minutes of on-premises failure). DR tested successfully during migration — the first successful DR test in the entity's history. (6) Migration execution: migrated in 4 waves over 12 weeks. Wave 1: internal tools and development environments (lowest risk — 8 applications). Wave 2: back-office applications (finance, HR — 10 applications). Wave 3: citizen-facing portal (highest visibility — migrated during a weekend with rollback plan). Wave 4: remaining applications and database consolidation (4 applications).
Availability: zero unplanned outages in the 8 months since migration (vs. 4 outages in the 12 months prior). The multi-AZ architecture eliminated the single-point-of-failure risk. Citizen portal performance: page load time reduced from 8-12 seconds to 1.8 seconds. Portal completion rate increased from 62% to 89% (applicants who start the process and complete it). Contact center call volume decreased by 40% — applicants who previously called because the portal was too slow now complete transactions online. The entity estimates SAR 1.2 million annual savings in contact center costs. NDMO compliance: the entity passed the NDMO digital maturity assessment with the cloud migration cited as a key achievement. The entity moved from Level 2 (Developing) to Level 3 (Defined) in the NDMO digital maturity model. NCA findings: 28 of the 31 NCA findings were resolved through the cloud migration (the cloud architecture inherently addressed patching, segmentation, and logging gaps). The remaining 3 findings (related to the retained on-premises systems) were addressed through supplementary security controls. DR capability: the entity now has tested DR capability for the first time. RTO (Recovery Time Objective): 15 minutes for cloud-hosted applications, 45 minutes for on-premises applications failing over to cloud DR. Cost: cloud operating cost (SAR 185,000/month) is 22% lower than the previous on-premises cost (SAR 238,000/month) — including the decommissioned hardware maintenance contracts. Migration project cost: SAR 890,000. Annual savings of SAR 636,000 (operating cost reduction) plus SAR 1.2 million (contact center cost reduction) provide payback within 6 months.
Migrate from on-premise or legacy hosting to the cloud with zero downtime and minimal disruption.
Build applications that fully leverage cloud services — serverless, managed databases, and auto-scaling.
Avoid vendor lock-in with architectures that work across AWS, GCP, and Azure.
Audit and optimize your cloud spend. Reserved instances, spot pricing, and right-sizing to cut costs by 30-50%.
IAM policies, encryption, VPCs, and compliance frameworks to protect your cloud infrastructure.
24/7 monitoring, maintenance, and optimization of your cloud environment so you can focus on your product.
Riyadh cloud options include: global hyperscaler professional services (AWS, Azure, Google Cloud professional services — platform expertise but limited NCA/NDMO regulatory depth), global system integrators (Accenture, Deloitte, IBM — enterprise cloud migration capability at SAR 2-5 million+ for comparable scope), regional managed service providers (Elm, STC Solutions, Mobily Business — Saudi market understanding with varying cloud engineering depth), and offshore cloud teams (Indian MSPs — cost-effective but limited understanding of Saudi data classification, NCA controls, and NDMO compliance). The gap: hyperscaler professional services know their platform but not Saudi regulatory requirements. System integrators deliver comprehensive migrations but at enterprise prices that only the largest organizations justify. Regional MSPs vary widely in cloud engineering capability. ZTABS delivers NCA/NDMO-compliant cloud migration with hands-on engineering at mid-market price points accessible to government entities and Saudi enterprises.
Cloud services in Riyadh range from SAR 100,000 for focused cloud migration of 5-10 workloads to SAR 1,500,000+ for enterprise-wide digital transformation. Government entity migration (as in the case study): SAR 890,000. SME cloud migration (10-15 applications): SAR 150,000-300,000. Cloud cost optimization engagement: SAR 50,000-80,000 (typically saves 25-40% on monthly cloud spend). Managed cloud operations: SAR 15,000-50,000/month depending on infrastructure size.
Verified reviews from real client engagements — sourced from our public testimonial archive and Clutch profile.
My experience is throughout positive. Communication, service, the short response times and the flawless execution of a challenging topic was absolutely great. ZTABS is definitely my first choice again.
Christian Neff
Bank Software Advisory · Bank Software Advisory
Fintech
Fantastic Agency! I couldn't fault them even if I tried. They always go above and beyond to meet your expectations and always produces quality work. Thank you ZTABS.
Stephanie Kal
CEO · Beauty Finder Australia
Marketplace
It has been great working with ZTABS. They bounce off the ideas along the way. Amazing Experience.
Joel Rowe
CEO · Drill Quoter
Marketplace
We don't just contract — we ship and operate our own software. 17 products in production.
Common questions about cloud for Riyadh businesses
Depends on data classification and existing technology stack. AWS Middle East (Bahrain) has the broadest service portfolio and best regional maturity. Azure is preferred for organizations deeply invested in Microsoft (Office 365, Dynamics, Active Directory). Oracle Cloud (Jeddah) for Oracle database workloads. Google Cloud (Dammam) for data analytics and AI workloads. STC Cloud for organizations requiring Saudi-sovereign infrastructure. Many Saudi enterprises use multi-cloud — AWS for application hosting, Azure for Microsoft integration, and specialized providers for specific workloads.
ZTABS is a remote-first cloud agency serving Houston businesses — including cloud migration, cloud-native development, multi-cloud strategy. We work with Energy & Oil/Gas, Healthcare & Biotech, Aerospace & Defense companies in Houston, TX via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Cloud in New York, NYZTABS is a remote-first cloud agency serving New York businesses — including cloud migration, cloud-native development, multi-cloud strategy. We work with Finance & Fintech, Media & Advertising, Fashion & Retail companies in New York, NY via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Cloud in Los Angeles, CAZTABS is a remote-first cloud agency serving Los Angeles businesses — including cloud migration, cloud-native development, multi-cloud strategy. We work with Entertainment & Media, E-commerce & DTC Brands, Gaming & AR/VR companies in Los Angeles, CA via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Web Development in Riyadh, Saudi ArabiaZTABS is a remote-first web development agency serving Riyadh businesses — including full-stack development, progressive web apps, api development. We work with GovTech, FinTech, Energy Tech companies in Riyadh, Saudi Arabia via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Web Design in Riyadh, Saudi ArabiaZTABS is a remote-first web design agency serving Riyadh businesses — including ui/ux design, responsive design, custom interfaces. We work with GovTech, FinTech, Energy Tech companies in Riyadh, Saudi Arabia via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
AI Development in Riyadh, Saudi ArabiaZTABS is a remote-first AI development agency serving Riyadh businesses — including llm integration & fine-tuning, ai agents & automation, rag & knowledge systems. We work with GovTech, FinTech, Energy Tech companies in Riyadh, Saudi Arabia via timezone-aligned engineers and async workflows; we do not have a local office, and we are explicit about that with every client.
Cloud ServicesLearn more about our cloud services nationwide.
Partner with ZTABS for expert cloud in Riyadh. Get a free consultation today.
