The SAMA Cyber Security Framework: Governance and Accountability

The Saudi Central Bank (SAMA) Cyber Security Framework establishes a mandatory baseline for financial institutions operating in the Kingdom. Unlike aspirational guidance, the framework carries supervisory weight: banks and financial services firms must demonstrate active, documented compliance or face enforcement action. The framework aligns with international standards—notably ISO/IEC 27001:2022 and NIST CSF 2.0—while embedding Saudi regulatory context and the Saudi Personal Data Protection Law (PDPL) requirements.

SAMA's expectations centre on three pillars: governance and risk ownership, technical and operational resilience, and incident response and recovery. Each pillar requires evidence, not assertions.

Governance Evidence: Board and Committee Oversight

SAMA expects the Board of Directors and audit committees to own cybersecurity risk. Evidence of this includes:

  • Board minutes and resolutions documenting cyber risk appetite, strategy approval, and regular (at least quarterly) cyber briefings.
  • Cyber risk policy framework—published, versioned, and signed off by the Board—covering incident response, third-party risk, and data protection aligned to the PDPL.
  • Chief Information Security Officer (CISO) charter with direct reporting line to the Board or audit committee, independent budget authority, and documented escalation protocols.
  • Risk register and heat maps showing cyber risk assessment, prioritisation, and mitigation tracking across the institution.

These artefacts must be maintained under version control and reviewed annually. SAMA examiners will request them during supervisory visits.

Technical and Operational Controls: The Control Inventory

SAMA aligns with NCA ECC (National Cybersecurity Authority Essential Cyber Controls) and expects documented implementation of controls across:

  • Access management: Multi-factor authentication logs, role-based access control matrices, privileged access management (PAM) audit trails, and segregation of duties evidence.
  • Data protection: Encryption inventories (at rest and in transit), data classification registers, and PDPL compliance records—including consent logs and data subject request handling procedures.
  • Network security: Firewall rule sets, intrusion detection/prevention logs, network segmentation diagrams, and vulnerability scan results with remediation tracking.
  • Endpoint and application security: Patch management schedules, anti-malware deployment records, secure code review findings, and software bill-of-materials (SBOM) for critical applications.
  • Monitoring and logging: Security Information and Event Management (SIEM) configuration documentation, log retention policies, and alert tuning records showing active threat hunting.

The key is control mapping: each control should be linked to a SAMA framework requirement, a responsible owner, a test method, and recent test results. A control inventory spreadsheet or dedicated governance, risk, and compliance (GRC) platform is essential.

Incident Response and Recovery: Preparedness Proof

SAMA mandates incident response and business continuity readiness. Evidence includes:

  • Incident Response Plan—current, tested, and signed by leadership—with defined roles, escalation paths, and notification procedures (including SAMA notification timelines).
  • Tabletop exercise records conducted at least annually, documenting scenario, participants, findings, and remediation actions.
  • Business Continuity and Disaster Recovery (BC/DR) test results showing recovery time objectives (RTOs) and recovery point objectives (RPOs) are met and documented.
  • Third-party incident response contracts and forensic retainer agreements in place.

Continuous Monitoring and Reporting

SAMA expects live, dashboard-based visibility into cyber posture. Institutions should maintain:

  • A cyber risk dashboard updated monthly, showing vulnerability counts, patch compliance rates, incident trends, and control test results.
  • Regulatory reporting templates aligned to SAMA's cyber incident notification requirements and PDPL breach reporting obligations.
  • Third-party risk assessments (vendors, cloud providers, payment processors) with documented remediation of findings.

Practical Next Steps

Financial institutions should conduct a gap assessment against the SAMA framework, assign ownership for each control, establish a testing schedule, and centralise evidence in a GRC tool or secure repository. Compliance is not a one-time audit; it is continuous demonstration of resilience and accountability.