An escrow deposit has to be operable
CST guidance looks for assurance that escrowed software can actually be operated, not only that a deposit exists.
Castler rebuilds and deploys the deposit, turning it into a proven, runnable system.
MIDDLE EAST · SAUDI ARABIA & UAE
Saudi Arabia's CST Software Escrow Guideline and the ADGM FSRA's IT risk guidance both focus on keeping critical services running when a technology provider can no longer deliver. Compare the two frameworks and see where custody and signed Proof of Recovery evidence fit.
Regional evidence map
Middle East
CST Escrow
Software-escrow and continuity arrangements for critical technology
ADGM FSRA IT Risk
Technology and information risk, outsourcing and resilience of third-party critical systems
One evidence set for both
Signed Proof of Recovery
FRAMEWORKS IN THIS REGION
Each framework page covers the issuing body, exact requirement, scope, timeline, consequences and how Castler's custody and recovery artefacts map to it.
SIDE BY SIDE
Regulator
Communications, Space & Technology Commission (CST)
Instrument
Software Escrow Guideline
Status
Published guidance
Applies to
Organisations that depend on critical technology, subject to current CST requirements and contractual obligations
Focus
Software-escrow and continuity arrangements for critical technology
Regulator
ADGM Financial Services Regulatory Authority (FSRA)
Instrument
Information Technology Risk Management Guidance
Status
Current FSRA guidance
Applies to
FSRA-authorised firms, applied proportionately to their activities and risk profile
Focus
Technology and information risk, outsourcing and resilience of third-party critical systems
Summaries support orientation. For exact operative wording, use the current official text and advice applicable to your supervisory perimeter.
WHAT THE FRAMEWORKS SHARE
The wording differs by regulator. The operational question is the same: can the critical service keep running if the vendor behind it fails?
CST guidance looks for assurance that escrowed software can actually be operated, not only that a deposit exists.
Castler rebuilds and deploys the deposit, turning it into a proven, runnable system.
The FSRA expects firms to manage the resilience of outsourced and third-party-provided critical systems and oversee material outsourcing.
Critical third-party systems are independently re-verified on every release.
Both frameworks cover continuity of critical services, with the FSRA also expecting disaster-recovery capability.
A signed Proof of Recovery shows the recovery path has been executed, not just documented.
HOW CASTLER FITS
A stored deposit gives you a legal path to the materials. Independent verification shows the recovery path has been exercised. Castler separates the two so you can start with custody and add verification when the framework or your board asks for it.
FAQ
This hub covers Saudi Arabia's CST Software Escrow Guideline and the ADGM FSRA Information Technology Risk Management Guidance. Each framework has its own evidence page with scope, status, consequences and a requirement-by-requirement mapping.
No single universal deadline applies. The guideline is reference guidance, so organisations should confirm applicability against current CST requirements and their contractual obligations.
It informs authorisation and supervisory review for firms regulated by the FSRA in Abu Dhabi Global Market. Firms apply it proportionately to their activities and risk profile.
Yes. The same custody, verification and Proof of Recovery artefacts are mapped to each framework's language, so a group operating in both markets keeps one evidence set per critical application.
KEEP EXPLORING
MIDDLE EAST
Bring your Middle East perimeter. We'll map the critical systems, current custody and Proof of Recovery evidence each framework expects.
Book a 15-min Demo