This Government Procurement Annex (“Annex”) defines additional contractual, technical, governance, and compliance commitments applicable when services are procured by:

• Saudi government ministries
• Authorities and regulators
• Semi-government entities
• State-owned enterprises
• Vision 2030 programs
• Regulated critical-infrastructure operators

This Annex supplements and prevails over standard commercial terms where applicable.

K® (Kenzie) of SAUDI GULF HOSTiNG commits to operating in alignment with applicable Saudi regulations, including but not limited to:

• Saudi Personal Data Protection Law (PDPL)
• National Cybersecurity Authority (NCA) controls
• Cloud Computing Regulatory Framework (CCRF)
• Communications, Space & Technology Commission (CST) regulations
• Relevant sector-specific regulations
• Applicable Royal Decrees and implementing regulations

3. Ministry-Specific Customization Framework

3.1 Ministry of Communications & Information Technology (MCIT)

Applicable Use Cases:

• National digital platforms
• Cloud transformation programs
• Data localization initiatives
• Smart government services

Kenzie Commitments:

• Saudi-based hosting options
• Tier III / Tier IV architecture
• Government-grade access governance
• Compliance documentation on request
• Alignment with national digital infrastructure goals

3.2 National Cybersecurity Authority (NCA) / Security-Sensitive Bodies

Applicable Use Cases:

• Cyber defense platforms
• SOC infrastructure
• Incident response systems
• Threat intelligence platforms

Kenzie Commitments:

• Defense-in-depth security architecture
• Controlled administrative access
• Audit-ready logging
• Incident escalation procedures
• Cooperation with lawful investigations

3.3 Ministry of Interior / Public Safety Authorities

Applicable Use Cases:

• Identity systems
• Public safety platforms
• Emergency response infrastructure

Kenzie Commitments:

• High-availability hosting
• Secure access segregation
• Controlled data residency
• Rapid incident response
• Evidence preservation capability

3.4 Ministry of Health & Healthcare Authorities

Applicable Use Cases:

• Electronic health records
• Telemedicine platforms
• Healthcare AI systems

Kenzie Commitments:

• High confidentiality controls
• Access governance
• AI workload governance
• Secure backup & recovery
• Compliance with health data sensitivity standards

3.5 Ministry of Finance & Financial Regulators

Applicable Use Cases:

• Treasury systems
• Financial reporting platforms
• Government payments infrastructure

Kenzie Commitments:

• Tier III / IV fault tolerance
• Financial-grade uptime
• Controlled third-party access
• Audit and compliance evidence support

3.6 Saudi Central Bank (SAMA) & Financial Sector

Applicable Use Cases:

• Banking platforms
• Payment systems
• Fintech infrastructure

Kenzie Commitments:

• Segregated environments
• High-availability architecture
• DR strategies aligned with regulatory expectations
• Compliance reporting support

3.7 Energy, Utilities & Industrial Authorities

Applicable Use Cases:

• Grid monitoring systems
• Energy analytics
• Industrial IoT platforms

Kenzie Commitments:

• IT/OT environment separation
• Resilience-focused architecture
• Secure access governance
• Availability-first design

3.8 Telecommunications & Digital Infrastructure Authorities

Applicable Use Cases:

• Core network services
• Subscriber platforms
• National connectivity systems

Kenzie Commitments:

• Ultra-high availability
• Network isolation
• Fault tolerance
• Geographic redundancy (approved regions only)

For government procurement contracts:

• Data residency requirements must be explicitly specified
• Sovereign workloads may be restricted to KSA-only infrastructure
• Cross-border processing is disabled unless contractually approved
• Backup and DR locations are disclosed and approved

Kenzie will not relocate regulated data without written authorization.

Government environments include:

• Named user access
• Role-based permissions
• Privileged access logging
• Geographic access restrictions
• Segregation of duties
• Vendor access governance

For government workloads, Kenzie supports:

• Defined escalation paths
• Incident classification and response
• Evidence preservation
• Cooperation with regulators and authorities
• Executive-level notification where required

Kenzie supports:

• Regulatory audits
• Compliance documentation
• Architecture reviews
• Evidence generation
• Procurement-required attestations

Subject to law and contract.

All government and critical-infrastructure data is treated as:

• Confidential
• Restricted
• Protected in accordance with Saudi law

Employees and contractors are bound by confidentiality and security obligations.

Upon termination:

• Data is returned or securely deleted
• Evidence of deletion may be provided
• Transition assistance may be offered

This Annex is governed by the laws of the Kingdom of Saudi Arabia.

K® (Kenzie) SAUDI GULF HOSTiNG
an Enterprise of Company Kanz AlKhaleej AlArabi,

All rights Reserved