Understanding SAMA CSF Scope and Expectations

The Saudi Central Bank's Cyber Security Framework (SAMA CSF) applies to all financial institutions operating in Saudi Arabia, including banks, insurance companies, and payment service providers. Unlike aspirational frameworks, SAMA CSF is prescriptive and enforceable. Institutions must demonstrate not only that controls exist, but that they are operating effectively and generating measurable outcomes.

SAMA CSF aligns with international standards—particularly NIST CSF 2.0 and ISO/IEC 27001:2022—while incorporating Saudi regulatory priorities, including data protection under the Personal Data Protection Law (PDPL) and alignment with the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC).

Core Evidence Categories Required

Governance and Risk Management

SAMA expects documented governance structures that assign clear cybersecurity accountability. Evidence includes:

  • Board-approved cybersecurity strategy and annual risk assessments
  • Cybersecurity committee minutes showing regular review of threats, incidents, and control effectiveness
  • Role and responsibility matrices mapping accountability for each SAMA control domain
  • Third-party risk management policies with audit evidence of vendor assessments
  • Incident response plans with documented tabletop exercises and post-incident reviews

These artifacts demonstrate that cybersecurity is treated as a business function, not merely a technical checkbox.

Technical Controls and Architecture

SAMA requires evidence that critical systems are protected through layered, documented controls:

  • Network architecture diagrams showing segmentation, perimeter defenses, and data flow controls
  • Configuration baselines and change management logs for critical systems
  • Encryption inventory covering data at rest and in transit, with key management procedures
  • Access control matrices showing principle-of-least-privilege implementation and periodic review records
  • Vulnerability management reports: scan results, remediation timelines, and closure evidence
  • Backup and disaster recovery test results with documented recovery time objectives (RTOs) and recovery point objectives (RPOs)

Auditors expect to see not just policies, but operational logs proving controls are active and monitored continuously.

Detection, Response, and Resilience

SAMA mandates a functioning Security Operations Center (SOC) or equivalent monitoring capability. Required evidence includes:

  • SOC monitoring logs, alert tuning records, and false-positive reduction metrics
  • Incident logs with timeline documentation, root cause analysis, and corrective actions
  • Threat intelligence integration records showing how external threat data informs detection rules
  • Business continuity and disaster recovery plan versions, test schedules, and results
  • Training completion records for incident response teams and security awareness for all staff

Documentation and Audit Trail Best Practice

SAMA audits typically request evidence spanning 12 to 24 months. Institutions should maintain:

  • Control matrices mapping each SAMA requirement to implemented controls, responsible teams, and evidence location
  • Audit schedules showing regular internal and external assessments, with findings tracked to closure
  • Change logs for policies, configurations, and security tools, with approval trails
  • Compliance dashboards updated monthly, showing control status and remediation progress
  • Gap assessments conducted annually, with action plans and executive sponsorship

Documentation should be centralized in a governance, risk, and compliance (GRC) platform or equivalent system to ensure consistency and auditability.

Alignment with NCA ECC and PDPL

SAMA CSF compliance overlaps significantly with the National Cybersecurity Authority's Essential Cybersecurity Controls (ECC) and the PDPL's data protection and incident notification requirements. Institutions should map SAMA controls to NCA ECC and ensure PDPL-mandated data processing agreements, privacy impact assessments, and breach notification procedures are documented and regularly tested.

Preparing for SAMA Examination

Financial institutions should conduct pre-examination self-assessments using the SAMA CSF control checklist, engage external auditors to validate evidence quality, and maintain a remediation backlog with realistic timelines. SAMA expects continuous improvement, not perfection; evidence of a mature, responsive governance process is more valuable than a static compliance posture.