🔐 Cybersecurity Glossary

A mandatory requirement under SAMA CSF for financial institutions to report significant cybersecurity incidents to SAMA within specified timeframes. Organizations must notify SAMA of material incidents that affect confidentiality, integrity, or availability of financial systems or customer data, typically within 72 hours of detection for critical incidents. Reporting must include incident classification, impact assessment, affected systems, customer impact, containment measures, and remediation plans. This obligation ensures regulatory oversight, enables sector-wide threat intelligence sharing, and supports coordinated response to systemic cyber threats affecting Saudi Arabia's financial sector stability.

A documented set of predefined procedures and workflows that guide SOC teams through the process of identifying, containing, eradicating, and recovering from specific types of security incidents, ensuring consistent and effective response actions.

An event or series of events that indicates a potential or actual breach of information security policies, unauthorized access to systems or data, disruption of services, or any occurrence that threatens the confidentiality, integrity, or availability of information assets.

A comprehensive solution that provides real-time analysis of security alerts generated by applications and network hardware. SIEM systems collect, aggregate, and analyze log data from across an organization's IT infrastructure to identify security threats, ensure compliance, and support incident investigation and forensics.