Multi-Cloud Governance Framework for Secure and Scalable Enterprise Cloud Adoption in Saudi Arabia

References

[1] Gill, S. S., Tuli, S., Xu, M., Singh, I., Singh, K. V., Lindsay, D., et al. (2020). Transformative effects of IoT, blockchain and artificial intelligence on cloud computing. Internet of Things, 12, 100250.

[2] Saxena, D., Gupta, R., & Singh, A. K. (2021). A survey and comparative study on multi-cloud architectures: Emerging issues and challenges for cloud federation. Journal of Cloud Computing Research.

[3] Saudi Communications, Space and Technology Commission. (2024). Cloud Computing Services Provisioning Regulations. Riyadh: CST.

[4] National Cybersecurity Authority. (2024). Essential Cybersecurity Controls ECC-2:2024. Riyadh: NCA.

[5] National Cybersecurity Authority. (2024). Cloud Cybersecurity Controls CCC-2:2024. Riyadh: NCA.

[6] National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework 2.0. NIST Cybersecurity White Paper 29.

[7] Cloud Security Alliance. (2021). Cloud Controls Matrix Version 4.0. Seattle: CSA.

[8] FinOps Foundation. (2024). FinOps Framework: Operating model for cloud financial management. Linux Foundation.

[9] International Organization for Standardization. (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection. Geneva: ISO.

[10] International Organization for Standardization. (2022). ISO/IEC 27002:2022 Information security controls. Geneva: ISO.

[11] Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero Trust Architecture. NIST Special Publication 800-207.

[12] Rodigari, S., O'Shea, D., McCarthy, P., McCarry, M., & McSweeney, S. (2021). Performance analysis of zero-trust multi-cloud. IEEE Cloud Computing Workshops.

[13] Reece, M., Lander, T. E., Stoffolano, M., Sampson, A., Dykstra, J., Mittal, S., & Rastogi, N. (2023). Systemic risk and vulnerability analysis of multi-cloud environments. arXiv preprint.

[14] Ghasemshirazi, S., Shirvani, G., & Alipour, M. A. (2023). Zero trust: Applications, challenges, and opportunities. ACM Computing Surveys preprint.

[15] Khan, A., & Gupta, S. (2021). Cloud governance challenges and opportunities in enterprise digital transformation. Information Systems Frontiers, 23, 1-18.

[16] Kumar, R., & Goyal, R. (2022). On cloud security requirements, threats, vulnerabilities and countermeasures: A survey. Computer Science Review, 43, 100434.

[17] Al-Somali, S. A., Saqr, R. R., Asiri, A. M., & Al-Somali, N. A. (2024). Organizational cybersecurity systems and sustainable business performance of SMEs in Saudi Arabia. Sustainability, 16, 1880.

[18] Almulhem, A. (2020). Cloud computing adoption in Saudi Arabia: Security, compliance and organizational readiness. Journal of Information Security and Applications, 52, 102492.

[19] Alotaibi, M., & Almagwashi, H. (2021). Cybersecurity governance in Saudi organizations: Challenges and policy directions. International Journal of Advanced Computer Science and Applications, 12(9), 251-260.

[20] Alahmadi, B., & Duncan, B. (2021). Cybersecurity risk management in cloud computing for critical organizations. Computers & Security, 108, 102347.

[21] Dillon, T., & Vossen, G. (2020). Cloud computing and enterprise architecture: Review of integration and governance issues. Enterprise Information Systems, 14(8), 1083-1105.

[22] Kumar, P., Kumar, R., Gupta, G. P., Tripathi, R., & Gadekallu, T. R. (2022). Security and privacy issues in cloud computing: Survey and open challenges. Journal of Cloud Computing, 11, 1-31.

[23] Mohammed, F., Ibrahim, O., & Nilashi, M. (2020). Cloud computing adoption model for government organizations. Telematics and Informatics, 54, 101453.

[24] Alharbi, F., Atkins, A., & Stanier, C. (2020). Strategic value of cloud computing in healthcare and digital government. Health Informatics Journal, 26(4), 2813-2830.

[25] Carvalho, A., & Sousa, P. (2021). Cloud service provider selection and multi-cloud risk management. Journal of Systems and Software, 176, 110948.

[26] Bhardwaj, A., Mangat, V., Vig, R., Halder, S., & Conti, M. (2021). Distributed denial of service attacks in cloud computing: A review. Journal of Network and Computer Applications, 184, 103058.

[27] Moura, J., Hutchison, D., & Gomes, D. (2022). Cloud resilience engineering: Concepts, patterns and evaluation metrics. Future Generation Computer Systems, 128, 1-15.

[28] Singh, A., Chatterjee, K., & Buyya, R. (2022). Cloud computing for digital transformation: Governance and sustainability perspectives. Sustainable Computing: Informatics and Systems, 35, 100748.

[29] Rashid, A., & Chaturvedi, A. (2023). Cloud governance and compliance automation for regulated enterprise systems. IEEE Access, 11, 57621-57639.

[30] McIntosh, T. R., Susnjak, T., Liu, T., Watters, P., & Nowrozy, R. (2024). Evaluating cybersecurity governance frameworks for regulatory compliance in emerging digital systems. Computers & Security, 138, 103662.

@article{1719815,
      author = {Mohsin Tahir},
      title = {Multi-Cloud Governance Framework for Secure and Scalable Enterprise Cloud Adoption in Saudi Arabia},
      journal = {Iconic Research And Engineering Journals},
      year = {2026},
      volume = {10},
      number = {1},
      pages = {1278-1289},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1719815.pdf},
      abstract = {Multi-cloud adoption is shifting from an optional sourcing tactic to a strategic operating model for Saudi enterprises that need to scale digital services, protect regulated data and sustain business continuity across complex provider ecosystems. This paper proposes a governance framework for secure and scalable enterprise cloud adoption in Saudi Arabia, with a focus on critical workloads in government services, banking, energy, healthcare, logistics, retail, and industrial operations. The paper adopts a structured narrative review approach influenced by recent systematic review practice in cloud computing, social mobile analytics and cloud-based service environments. Literature and standards published between 2020 and 2025 were synthesised to identify domains of governance, barriers to adoption, security controls, mechanisms of resilience and enablers of implementation. The review argues that delivering multi-cloud value is more than just spreading workloads across multiple providers. Value is delivered when executive accountability, data classification, identity governance, policy-as-code, observability, financial control, incident response, sovereignty requirements and vendor exit planning are managed by a single control plane. Governance should also be aligned with the Saudi context in terms of national cybersecurity controls, cloud service provisioning rules, data localisation expectations, and Vision 2030 digital transformation priorities. Our proposed framework has six dimensions: Strategic alignment, regulatory compliance, secure architecture, operational resilience, FinOps enabled scalability and continuous assurance. The review is translated into an adoption roadmap with two graphical models and two synthesis tables. The study concludes that Saudi enterprises can reduce vendor dependency and accelerate innovation via multi-cloud but only if governance is continuous, evidence-based and embedded into engineering workflows.},
      keywords = {Multi-Cloud Governance, Enterprise Cloud Adoption, Saudi Arabia, Cybersecurity, Cloud Compliance, Scalable Cloud Architecture, Cloud Resilience, Finops, Cloud Security, Digital Transformation.},
      month = {July},
      doi = {https://doi.org/10.64388/IREV10I1-1719815}
  }