Technology Selection
How to Choose a GRC Platform for SAMA and NCA Compliance
Enterprise GRC suites and lightweight compliance automation tools solve different problems. How to work out which one you need — and avoid paying for the other.
Key takeaways
- All four providers are enterprise-grade; the differences are in fit, not capability.
- Existing licensing often matters more than list prices.
- Decide by workload, not by estate-wide declaration.
- Residency and regulatory obligations should be the first filter, not the last.
Start with the right question
“Which cloud is best?” has no useful answer. Microsoft Azure, Amazon Web Services, Google Cloud and Oracle Cloud Infrastructure are all mature, secure and globally used. The useful question is: which platform is the best fit for this workload, given our licensing, skills, obligations and three-year cost?
That question often produces different answers for different parts of the same estate — which is why most large organisations end up with more than one provider.
Where each provider is typically strongest
| Provider | Typical strengths | Worth checking |
|---|---|---|
| Microsoft Azure | Deep integration with Microsoft 365, Entra ID and Windows Server; licence benefits for existing Microsoft customers; strong hybrid options | Service availability varies by region; cost governance needs discipline |
| Amazon Web Services | The broadest service catalogue; mature tooling for multi-account governance; very large skills pool | Breadth can create complexity; data transfer costs deserve modelling |
| Google Cloud | Data analytics and machine learning; Kubernetes heritage; strong networking | Smaller partner ecosystem in some markets; enterprise support model to confirm |
| Oracle Cloud Infrastructure | Oracle Database and applications; predictable pricing; competitive compute and data transfer costs | Narrower non-Oracle service catalogue; skills availability to confirm |
These are tendencies, not rules. A Microsoft-heavy organisation can still run analytics best on Google Cloud; an Oracle estate can still land on Azure through interconnect arrangements. The workload decides.
The criteria that should decide
- Data residency and regulation. Can this data leave the Kingdom? If not, which providers offer in-Kingdom regions with the services you need, and how do they align with the NCA Cloud Cybersecurity Controls and PDPL transfer rules?
- Existing licensing. Bring-your-own-licence rights for Windows Server, SQL Server and Oracle can change the economics dramatically.
- Application fit. Some platforms are certified or optimised for specific enterprise applications.
- Skills. A platform your team can operate confidently is worth more than a marginally cheaper one they cannot.
- Integration. Identity, monitoring, networking and security tooling should work consistently.
- Support and presence. Local account teams, partners and support in your time zone matter during incidents.
- Three-year total cost. Include licences, data transfer, support plans, operations and eventual exit — not only compute prices.
- Portability. How much would it cost to move later, and does that matter for this workload?
The in-Kingdom question
For Saudi organisations, residency is usually the first filter. Government entities and critical infrastructure operators face strict hosting requirements, and PDPL restricts transfers of personal data abroad. Hyperscaler availability in the Kingdom has changed quickly in recent years, and in-country regions do not always offer the full global service catalogue. Confirm current regions, the specific services available in each, and how the provider evidences alignment with the NCA Cloud Cybersecurity Controls and CST cloud regulations before you design.
A decision method that works
- Classify workloads by data sensitivity and residency constraint.
- Group them by technical profile — Microsoft-centric, Oracle-centric, data and AI, cloud-native, legacy.
- Score shortlisted providers against weighted criteria agreed with the business.
- Model three-year cost for the top two options, including licensing benefits.
- Record the decision and its rationale so it can be defended — and revisited.
Multi-cloud: by design, not by accident
Using more than one provider is often the right answer, but it multiplies operational overhead unless it is deliberate. Standardise identity, infrastructure-as-code tooling, observability and security posture management across providers. Multi-cloud becomes expensive when each team chooses independently and the organisation inherits four different ways of doing everything.
Mistakes that make cloud decisions expensive
- Deciding on list prices. Discounts, licence mobility and committed-use agreements usually change the ranking.
- Ignoring data transfer. Egress charges and cross-region traffic can outweigh compute savings for data-heavy workloads.
- Choosing for the estate, not the workload. An estate-wide mandate forces poor fits for the workloads it does not suit.
- Underestimating skills. A platform your team cannot operate safely will cost more in incidents than it saves in licences.
- Leaving governance until later. Landing zones, identity and guardrails should be designed before the first migration wave, whichever provider you choose.
- Assuming service parity across regions. Confirm that every service your design depends on is available where your data must live.
A short, documented evaluation avoids all six. It also gives procurement and audit a clear record of why a platform was chosen — which matters when the decision is questioned two years later.
Frequently asked questions
Which cloud is cheapest?
It depends on the workload and your licensing. List prices are rarely decisive; licence mobility, committed-use discounts and data transfer patterns usually matter more.
Should we pick one cloud provider for everything?
Standardising on one provider simplifies operations, and many organisations do so successfully. Others choose a primary provider and use a second for specific workloads. Both can work if the decision is deliberate.
Can we move between clouds later?
Yes, but the cost varies. Containerised, infrastructure-as-code workloads move more easily than those built on proprietary managed services.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
