Level 4 Highly sensitive or secret Customer Content belonging to relevant governmental agencies or institutions 3.3.2 This Regulatory Framework shall be without prejudice to any rules applying to any Customer Content requiring a higher level of information security, including but not limited to Level 4 Customer Content, as may be determined by other competent authorities of the Kingdom. 3.3.3 The provisions of this Regulatory Framework shall be without prejudice to any applicable law, regulation, guideline, code of conduct, internal instruction, corporate policy or any other legal, regulatory, administrative or corporate rule, concerning: 3.3.3.1 the Cloud Customers’ right, if any, to outsource, transmit, process or store in a Cloud System Customer Content or any data or information; 3.3.3.2 the Cloud Customers’ obligation to ensure that, if allowed, any such outsourcing, transmission, processing or storage should be subject to certain information security or data protection restrictions or safeguards, in addition to those specified to this Regulatory Framework. Responsibility for Customer Content Classification 3.3.4 Cloud Customers must presume that the following levels of information security apply by category of Cloud Customer: 3.3.4.1 for natural persons with a Residence in the Kingdom: Level 1; 3.3.4.2 for private sector legal persons, such as companies, other corporate entities, associations or organizations incorporated or with a Customer Address in the Kingdom: Level 2; 3.3.4.3 for any government or State services or agencies: Level 3; 3.3.4.4 for all other categories: Level 1. 3.3.5 Cloud Customers shall be responsible for selecting the information security level among those listed in the table of Article ‎3.3.1 or other similar list provided for such purpose by the CSP, which best matches their specific needs, duties, obligations and security requirements. 3.3.6 Cloud Customers shall be responsible for implementing all information security features required for part or the whole of their Customer Content. Cloud Computing Regulatory Framework Page 6 of 15