ENHANCING CYBER RESILIENCE IN SAUDI ARABIA'S CRITICAL DIGITAL INFRASTRUCTURE: A RISK-BASED SECURITY FRAMEWORK SUPPORTING VISION 2030

Saudi Arabias drive to diversify its economy is contingent upon a suite of interconnected cloud platforms, industrial networks, digital government services and cyber-physical assets. Traditional cyber risk assessments tend to focus on the probability of compromise and are largely blind to the capacity of these critical services to tolerate disruption.This paper reviews how risk assessment, service dependency modelling and resilience engineering can be integrated into a practical framework for critical digital infrastructure in the context of Vision 2030. It is a structured integrative review of 30 DOI identifiable publications from 2020 to 2025, augmented by an assessment of the Saudi cybersecurity control documentation. The evidence is presented in the context of threat propagation, risk assessment technique, operational recoverability and governance accountability. Asset based scores fail to capture the dynamics of cascading disruption, recovery dependencies and industrial constraints. A six stage service centred framework is developed which links mission definition, dependency mapping, scenario analysis, proportionate controls, continuity exercises and adaptive assurance. A proposed measurement portfolio is presented which combines minimum service levels, duration of disruption, restoration integrity, supplier exposure and decision latency. The framework links national control requirements to outcomes that can be measured without in any way asserting that the outcomes are in fact achieved. The primary contribution of the paper is a transparent method by which protective and restorative investments can be prioritised in terms of their consequences for public services and industrial operations rather than in terms of isolated technical vulnerabilities.