Cloud Migration in Saudi Arabia: Case Study of a 40% Cut in Infrastructure Overhead
Key takeaways
- Fragmented legacy on-premise infrastructure and disconnected cloud services created overhead and cybersecurity gaps.
- Amwaj Solutions consolidated the estate onto a hybrid cloud architecture on AWS with unified identity management.
- Centralised monitoring, automated DevOps pipelines and NCA-aligned security controls were built into the design.
- Infrastructure overhead fell by 40%.
- The organisation now has a centralised security posture with continuous NCA compliance monitoring.
Cloud migration in Saudi Arabia is the move of workloads from legacy on-premise systems to cloud or hybrid infrastructure while meeting National Cybersecurity Authority (NCA) and data-protection requirements. In this case study, Amwaj Solutions consolidated a fragmented estate onto a hybrid cloud architecture on AWS, cutting infrastructure overhead by 40% and centralising security with continuous NCA compliance monitoring.
The challenge: why was the existing estate costly and exposed?
The organisation ran fragmented legacy on-premise infrastructure alongside disconnected cloud services. Together they created two problems across the organisation:
- Operational overhead: separate environments had to be run, patched and supported independently.
- Cybersecurity gaps: with no single view across environments, controls were inconsistent and weaknesses were harder to see.
This pattern is common. Estates that grow system by system typically end up with several identity stores, separate monitoring tools and manual deployments, and each one adds cost and another place for a gap to hide. We look at the cost side in the cost of legacy infrastructure for Saudi businesses.
Our approach: what does a consolidated hybrid cloud architecture include?
We designed a hybrid cloud architecture on AWS with four supporting capabilities. The table shows each component and the general problem it addresses.
| Component | What it typically replaces | Effect |
|---|---|---|
| Hybrid cloud architecture on AWS | Disconnected on-premise and cloud environments | One designed estate, with each workload placed where it fits best |
| Unified identity management | Separate accounts and permissions per system | One place to grant, review and revoke access |
| Centralised monitoring | Tool-by-tool alerts and blind spots | A single view of health and security events |
| Automated DevOps pipelines | Manual, inconsistent deployments | Repeatable releases with built-in checks |
| NCA-aligned security controls | Controls added system by system | Security designed in and applied consistently |
Why hybrid rather than all-cloud?
A hybrid design lets an organisation move workloads to the cloud where that makes sense while keeping others on-premise for reasons such as data classification, legacy dependencies or performance. The value comes from operating both as one estate, with shared identity, monitoring and controls. Our cloud migration strategy guide covers how to decide what moves and when.
The outcome: 40% reduction in infrastructure overhead
The published results are:
- 40% reduction in infrastructure overhead.
- Centralised security posture with continuous NCA compliance monitoring.
Both results come from the same decision: consolidation. Fewer separate environments mean less to run, and a single identity and monitoring layer means security can be measured continuously rather than checked occasionally.
Why does this matter for enterprises in Saudi Arabia?
- NCA ECC. The Essential Cybersecurity Controls, now ECC-2:2024 (which reduced the control count from 114 in ECC-1:2018 to 108), apply to government entities and to private organisations that own, operate or host Critical National Infrastructure. Identity and access management and event monitoring are core requirements.
- NCA CCC. The Cloud Cybersecurity Controls (CCC-2:2024) extend ECC to cloud computing for both providers and tenants. In-scope tenants must manage identity and access for all cloud credentials across their full lifecycle, use multi-factor authentication for privileged cloud users and monitor their cloud security logs. The 2024 update moved data localisation requirements to the National Data Management Office.
- Cloud First. The Ministry of Communications and Information Technology's Cloud First Policy directs civilian government entities to consider cloud solutions for new IT investments.
- PDPL. Personal data in any migrated workload remains subject to the Personal Data Protection Law, fully enforceable since 14 September 2024.
Unified identity and centralised monitoring are therefore not just efficiency measures; they map directly to what Saudi regulators expect. Our NCA ECC guide explains the controls in detail.
Is a cloud migration and consolidation right for your organisation?
It is a strong fit when:
- You run a mix of on-premise systems and cloud services that were never designed together.
- Access, monitoring and deployments are managed separately for each system.
- You are in scope of NCA ECC or CCC and need continuous evidence of compliance.
- Infrastructure cost is rising faster than the value it delivers.
If your data classification requires everything to stay on-premise, the same principles of unified identity, central monitoring and automation still apply within a private environment. To plan your next step, see our cybersecurity and compliance service or request a consultation; our team responds within 24–48 business hours.
Related service: Cybersecurity & NCA ECC
Case Study
Frequently Asked Questions
What is cloud migration and stack consolidation?
Cloud migration moves applications and data from on-premise infrastructure to cloud or hybrid environments. Stack consolidation goes further: it brings scattered systems, identity stores, monitoring tools and deployment processes into one designed architecture. In this case study, combining both on a hybrid AWS architecture cut infrastructure overhead by 40% and centralised the organisation's security posture.
Is hybrid cloud allowed under NCA requirements in Saudi Arabia?
Yes. NCA controls do not prohibit hybrid cloud; they set the security requirements it must meet. ECC-2:2024 sets baseline controls, and the Cloud Cybersecurity Controls (CCC-2:2024) add requirements for providers and in-scope tenants, such as identity lifecycle management, multi-factor authentication for privileged users and log monitoring. Data localisation questions are referred to the National Data Management Office.
How did this cloud migration reduce infrastructure overhead by 40%?
By consolidating fragmented legacy on-premise infrastructure and disconnected cloud services into a single hybrid cloud architecture on AWS, with unified identity management, centralised monitoring and automated DevOps pipelines. Running one designed estate instead of many separate environments removed duplicated effort, which produced the 40% reduction in infrastructure overhead alongside a centralised security posture.
What is continuous NCA compliance monitoring?
It means checking security controls against NCA requirements on an ongoing basis rather than only during periodic audits. With unified identity and centralised monitoring, an organisation can see access changes, configuration drift and security events as they happen, and evidence compliance at any time. This case study achieved a centralised security posture with continuous NCA compliance monitoring.
Do Saudi companies have to migrate to the cloud?
Not generally. The Cloud First Policy from the Ministry of Communications and Information Technology directs civilian government entities to consider cloud solutions for new IT investments, but private companies choose based on cost, risk and regulation. Whatever the model, entities in NCA scope must meet ECC, and cloud tenants in scope must also meet the Cloud Cybersecurity Controls.