RCMS: a robust cybersecurity metamodel for cloud computing in Saudi Arabia

Abstract

Abstract Cloud computing underpins Saudi Arabia’s Vision 2030, making cybersecurity an escalating national concern. Existing security frameworks incorporate relevant measures but lack cloud-specific constructs in identified areas and are not localized to Saudi regulatory requirements. This study has two objectives: to review existing cybersecurity approaches for cloud computing using the PRISMA methodology, appraising their strengths and weaknesses against a stated rubric; and to develop a high-level cybersecurity metamodel for cloud computing in Saudi Arabia, designated RCMS, through a metamodeling approach with modeling rules that include four compliance constraints expressed against NCA and SAMA obligations. RCMS defines seventeen concepts spanning AI-enhanced security, threat detection and incident response, data confidentiality and integrity, encryption, identity and device authentication, multi-cloud and critical infrastructure security, and data classification and residency. Each concept is mapped to Vision 2030 themes, NCA ECC-1:2018 controls and SAMA Cyber Security Framework domains. RCMS was appraised against thirteen security frameworks and eight security metamodels, and was instantiated for banking, healthcare and energy. The instantiations, and the accompanying threat modeling walkthrough, are illustrative and author-constructed; no measured deployment is reported. Practitioners can use RCMS to derive solution models for specific security challenges; scalability and reusability remain design intentions awaiting independent evaluation.