CYBER RESILIENCE FRAMEWORK FOR DISTRIBUTED GIGA-PROJECT IT INFRASTRUCTURE IN SAUDI ARABIA UNDER VISION 2030: INTEGRATING ISO 27001, ISO 22301, HYBRID-CLOUD SECURITY, BUSINESS CONTINUITY AND INCIDENT RECOVERY

Abstract

Saudi giga-projects depend on distributed digital infrastructure that spans construction sites, corporate offices, command centres,operational technology, private data centres, public cloud services, edge platforms and international suppliers. This distribution enables rapid delivery, yet it also creates tightly coupled dependencies across identity, networks, data, applications and third parties. A local cyber incident can therefore become a programme-wide operational disruption if trust boundaries, recovery priorities and decision authority are unclear. This review develops an integrated cyber-resilience framework for giga-project information technology under Vision 2030. It synthesises evidence published from 2020 to 2025 across information-security management, business continuity, hybrid-cloud architecture, zero trust, critical-infrastructure guidance and Saudi cybersecurity requirements. The framework joins ISO 27001 governance with ISO 22301-aligned continuity practices, service-based risk analysis, segmented hybrid-cloud controls, clean recovery, coordinated incident command and evidence-led assurance. The review argues that resilience cannot be demonstrated by control compliance, backup completion or nominal system availability in isolation. It must be shown through the continued delivery of prioritised business and operational outcomes during compromise, followed by trusted restoration within agreed tolerances.