Understanding SAMA's Cyber Security Framework Mandate

The Saudi Arabian Monetary Authority (SAMA) Cyber Security Framework establishes the baseline security and operational resilience requirements for all financial institutions operating under SAMA's supervision. The framework aligns with international standards including ISO/IEC 27001:2022 and NIST Cybersecurity Framework 2.0, while addressing the specific risk profile and regulatory environment of the Saudi financial sector.

SAMA's expectations span governance, risk management, technical controls, and incident response. Compliance is not a one-time assessment but an ongoing demonstration of maturity across these domains. Financial institutions must be able to evidence their control environment to SAMA examiners, internal auditors, and external assessors.

Core Evidence Requirements

Governance and Accountability

SAMA requires documented cyber governance structures with clear accountability. Evidence should include:

  • Board-level cyber risk oversight policies and meeting minutes demonstrating regular review of cyber posture
  • Defined roles and responsibilities for the Chief Information Security Officer (CISO) or equivalent, with direct reporting lines to senior management
  • Cyber risk committees with cross-functional representation and documented charter
  • Annual cyber risk assessments presented to the board, with remediation tracking

These artifacts demonstrate that cyber risk is treated as a business risk, not solely an IT function.

Risk Assessment and Management

SAMA expects institutions to maintain current, documented risk assessments aligned with ISO/IEC 27005 principles. Evidence includes:

  • Formal asset inventory covering systems, data, and critical infrastructure
  • Annual or event-triggered risk assessments with documented methodology, scope, and sign-off
  • Risk registers mapping identified threats to controls, residual risk ratings, and owners
  • Remediation plans with timelines and evidence of closure for high-risk findings
  • Third-party and supply-chain risk assessments, particularly for critical service providers

Documentation must demonstrate that risk decisions are informed, traceable, and aligned with the institution's risk appetite.

Technical and Operational Controls

SAMA's framework mandates controls across access management, data protection, monitoring, and resilience. Evidence includes:

  • Access control policies and periodic access reviews with sign-off, demonstrating least-privilege implementation
  • Encryption standards for data at rest and in transit, with key management procedures
  • Security Operations Center (SOC) or equivalent monitoring capabilities, with incident logs and response records
  • Vulnerability management programs with scanning results, patch timelines, and closure evidence
  • Business continuity and disaster recovery plans, tested at least annually, with test reports
  • Endpoint detection and response (EDR) or similar telemetry across critical systems

Controls should be mapped to SAMA framework requirements and international standards to show comprehensive coverage.

Incident Response and Reporting

SAMA requires documented incident response capabilities and timely reporting of material incidents. Evidence includes:

  • Incident response plan with defined escalation, investigation, and communication procedures
  • Incident logs with timeline, impact assessment, root cause analysis, and corrective actions
  • Timely notification to SAMA for reportable incidents, with follow-up communications
  • Post-incident reviews and lessons learned, with process improvements implemented

Building an Effective Evidence Trail

Documentation discipline: Maintain centralized repositories for policies, assessments, and control evidence. Use consistent naming, versioning, and approval workflows.

Automation: Leverage Security Information and Event Management (SIEM), vulnerability scanners, and configuration management tools to generate audit logs and compliance reports automatically.

Third-party alignment: Ensure external auditors, penetration testers, and assessors follow frameworks and standards that SAMA recognizes, and retain their reports as evidence.

Regular review: Conduct quarterly or semi-annual internal compliance reviews to identify gaps before SAMA examinations.

Training and awareness: Document staff training on security policies and incident reporting; this demonstrates a security-conscious culture.

Alignment with Saudi PDPL and NCA ECC

The Saudi Personal Data Protection Law (PDPL) and the National Cybersecurity Authority's Essential Cybersecurity Controls (ECC) complement SAMA's framework. Evidence of PDPL compliance (data processing agreements, breach notification procedures) and ECC alignment (critical infrastructure protection, supply-chain security) strengthens the overall control narrative.

Conclusion

SAMA compliance is demonstrated through systematic, documented evidence of governance, risk management, technical controls, and incident response. Security leaders should treat evidence collection as an integral part of their control program, not an afterthought to audits. By maintaining clear documentation and aligning controls to SAMA, ISO/IEC 27001:2022, and NIST frameworks, financial institutions can confidently evidence their cyber maturity and resilience.