Understanding SAMA CSF Expectations

The SAMA Cyber Security Framework (CSF) is the regulatory standard that governs cybersecurity practice across Saudi Arabia's financial sector. Unlike prescriptive checklists, the SAMA CSF is principles-based and outcome-focused, requiring institutions to demonstrate that they understand their risk environment, have designed appropriate controls, and can prove those controls are operating effectively.

For security leaders, this means compliance is not a one-time audit event but an ongoing practice of control design, implementation, monitoring, and evidence collection. Regulators expect to see clear documentation that connects business risk to control objectives, and that controls are tested and validated.

Core Evidence Categories Regulators Expect

Governance and Policy Documentation

SAMA requires institutions to maintain a documented cybersecurity strategy aligned with business objectives. Evidence includes:

  • Board-approved cybersecurity policy and strategy documents, dated and version-controlled
  • Risk appetite statements that define acceptable levels of cyber risk
  • Governance meeting minutes showing board or audit committee oversight of cybersecurity
  • Organizational structure charts showing clear accountability for security roles
  • Policy review and approval records demonstrating regular reassessment (typically annual or when the threat landscape changes materially)

Risk Assessment and Treatment Plans

SAMA expects institutions to conduct documented risk assessments aligned with frameworks such as ISO/IEC 27005 or NIST methodologies. Evidence includes:

  • Formal risk assessment reports identifying threats, vulnerabilities, and business impact
  • Risk treatment plans that map each identified risk to a control or mitigation strategy
  • Risk register updates showing the status and residual risk of each control
  • Evidence of stakeholder consultation (business units, IT, compliance, audit)

Control Implementation and Configuration

For each control in the SAMA CSF, institutions must evidence that it has been implemented and configured correctly. This includes:

  • System configuration baselines and hardening documentation
  • Access control matrices showing who has what privileges and why
  • Encryption inventory and key management procedures
  • Network diagrams and data flow maps showing security zones and controls
  • Change management logs showing how controls were deployed and tested before production

Testing and Validation

SAMA regulators distinguish between controls that are designed and controls that are operating effectively. Evidence of operating effectiveness includes:

  • Internal audit reports documenting control testing (sample sizes, test dates, results)
  • Penetration test and vulnerability assessment reports from qualified third parties
  • Security monitoring logs and SOC incident response records
  • Remediation tracking showing how identified gaps were closed
  • Control testing schedules and completion records (e.g., quarterly access reviews, annual disaster recovery drills)

Building a Sustainable Evidence Framework

Rather than treating compliance as a reactive response to audit requests, leading institutions build evidence collection into their operating model:

Automate where possible. Use security information and event management (SIEM) systems, configuration management databases (CMDB), and identity and access management (IAM) platforms to generate audit logs and compliance reports automatically. This reduces manual effort and improves consistency.

Establish a control library. Create a centralized repository (often a spreadsheet or dedicated GRC tool) that maps each SAMA CSF control to your organization's implementation, responsible owner, testing frequency, and evidence location. This becomes your single source of truth for auditors and internal review.

Schedule regular testing. Define a testing calendar for each control. High-risk controls (such as access management and incident response) may require quarterly or semi-annual testing; lower-risk controls may be tested annually. Document the schedule and track completion.

Engage compliance and audit early. Security leaders should work with compliance and internal audit teams to agree on evidence standards and testing approaches before the formal assessment. This alignment reduces friction and ensures evidence is collected in a format regulators expect.

Alignment with Broader Regulatory Landscape

The SAMA CSF operates alongside other Saudi and GCC frameworks. For institutions subject to the Saudi Personal Data Protection Law (PDPL), evidence of data protection controls (encryption, access logging, data retention policies) must also be maintained. Organizations handling payments must align with PCI DSS 4.0 requirements. This convergence means a well-designed control library should cross-reference controls to multiple frameworks, reducing duplication.

Key Takeaway

SAMA compliance is not about checking boxes; it is about demonstrating a mature, risk-informed approach to cybersecurity. Security leaders who build evidence collection into their daily operations—through automated monitoring, regular testing, and clear governance—will find regulatory assessments less burdensome and their security posture genuinely stronger.