Understanding SAMA CSF Expectations in Practice

The Saudi Central Bank (SAMA) Cyber Security Framework establishes mandatory security controls across governance, risk management, technical defence, and incident response. Unlike earlier versions that emphasized policy documentation alone, the current framework demands continuous evidence of control operation. Financial institutions now face scrutiny not on whether policies exist, but on whether they work and can be proven to work.

SAMA's supervisory approach aligns with the National Cybersecurity Authority (NCA) Executive Cybersecurity Code and international standards such as ISO/IEC 27001:2022 and NIST Cybersecurity Framework 2.0. This convergence means a single evidence base can satisfy multiple regulators—but only if institutions understand what "evidence" means in regulatory context.

The Five Categories of Required Evidence

1. Governance and Accountability

SAMA expects documented proof of:

  • Board-level cybersecurity oversight minutes and decisions
  • Defined roles and responsibilities with sign-off
  • Executive cyber risk reporting (quarterly or as required)
  • Policies approved and reviewed within defined intervals

Auditors will request board meeting minutes, committee charters, and evidence that cyber risk is escalated to decision-makers. A policy on file is insufficient; you must show it was read, understood, and acted upon.

2. Risk Assessment and Management

Institutions must maintain:

  • Annual or event-triggered risk assessments with documented scope and methodology
  • Risk register entries linked to controls and residual risk ratings
  • Treatment plans for risks rated above appetite
  • Audit trails showing risk re-evaluation after control changes

SAMA auditors will cross-reference the risk register against deployed controls. If a risk is identified but no control is documented, or if a control is deployed but not mapped to a risk, the evidence chain breaks. Use a centralized risk management tool that timestamps assessments and links them to control implementation.

3. Technical Control Operation

This is where most institutions struggle. Evidence must include:

  • Configuration baselines and change logs for critical systems
  • Firewall, intrusion detection, and endpoint protection logs (sampled and analyzed)
  • Patch management records showing deployment timelines and exceptions
  • Access control matrices and periodic user access reviews with sign-off
  • Encryption deployment confirmations and key management audit trails

Auditors will request 30–90 days of representative logs. Do not simply produce raw log files; prepare analyzed summaries showing what was detected, how it was handled, and what remains unresolved. A SOC or SIEM that correlates events and generates management reports is essential.

4. Incident Response and Business Continuity

Required evidence includes:

  • Incident response plan with defined escalation and communication procedures
  • Tabletop exercise reports conducted at least annually
  • Records of actual incidents, response actions, and root cause analysis
  • Business continuity and disaster recovery test results with recovery time and data loss measurements
  • Lessons learned and corrective actions implemented

SAMA expects to see that your organization has tested its ability to detect, respond to, and recover from cyber incidents. Simulations and drills should be documented with attendance, findings, and follow-up actions.

5. Third-Party and Supply Chain Risk

Evidence must show:

  • Inventory of critical third-party service providers and their security assessments
  • Contractual security clauses and audit rights
  • Periodic vendor security reviews (at least annually)
  • Monitoring of third-party incidents and remediation tracking

Practical Steps to Build an Evidence Repository

Centralize documentation: Use a governance, risk, and compliance (GRC) platform to store policies, assessments, logs, and audit reports in one searchable location with version control and audit trails.

Automate evidence collection: Configure systems to generate compliance reports automatically (e.g., monthly access reviews, patch status, vulnerability scan results).

Establish review cycles: Schedule quarterly reviews of key controls with documented sign-off. This demonstrates continuous oversight and catches gaps early.

Link evidence to standards: Map each piece of evidence to the specific SAMA CSF requirement, NCA ECC control, and ISO/IEC 27001 clause it satisfies. Auditors will expect this cross-reference.

Prepare for data protection: Ensure all evidence respects the Saudi Personal Data Protection Law (PDPL) and NCA guidelines. Anonymize or redact personal data in logs and reports before submission.

What Auditors Will Ask

Expect questions such as:

  • "Show me the last three months of access reviews and who approved them."
  • "Walk me through a recent incident from detection to closure."
  • "How do you know your firewall rules are still aligned with your risk assessment?"
  • "What happened the last time a critical patch was released, and how long did it take to deploy?"

Your ability to answer these questions with documented evidence—not from memory—determines compliance maturity. Auditors are testing whether your controls are designed, implemented, and operating effectively.

Conclusion

SAMA compliance in 2026 is not about filing forms; it is about demonstrating that cybersecurity is embedded in your organization's operations. Build an evidence repository now, automate collection where possible, and treat audits as a conversation about your security posture, not a box-ticking exercise. Organizations that shift from policy-only compliance to operational evidence will navigate regulatory scrutiny with confidence and, more importantly, reduce their actual cyber risk.