Understanding SAMA CSF Scope and Governance

The Saudi Arabian Monetary Authority (SAMA) Cyber Security Framework establishes baseline and advanced security controls for all licensed financial institutions, payment service providers, and critical infrastructure operators under SAMA oversight. The framework aligns with international standards—including NIST Cybersecurity Framework 2.0, ISO/IEC 27001:2022, and the National Cybersecurity Authority's Essential Cybersecurity Controls (NCA ECC)—while reflecting Saudi Arabia's regulatory priorities and risk environment.

Compliance is not optional. SAMA expects financial institutions to implement controls mapped to six core domains: governance and risk management, asset management, access control, data protection, incident response, and business continuity. Each domain contains specific control requirements, and institutions must demonstrate active, documented implementation.

Core SAMA CSF Domains and Evidence Expectations

Governance and Risk Management

SAMA requires a documented cybersecurity strategy, board-level accountability, and a Chief Information Security Officer (CISO) or equivalent with clear authority. Evidence includes:

  • Board-approved cybersecurity policy and risk appetite statements
  • Annual risk assessments with documented scope, methodology, and findings
  • CISO appointment letter and organizational reporting structure
  • Governance meeting minutes showing cybersecurity oversight

Asset Management and Inventory

Institutions must maintain a complete, current inventory of IT and operational technology assets, including hardware, software, and data repositories. Evidence includes:

  • Automated asset discovery and management tools with audit logs
  • Configuration baselines for critical systems
  • Software license and version tracking records
  • Data classification and mapping documentation

Access Control

SAMA mandates role-based access control (RBAC), multi-factor authentication (MFA) for privileged accounts, and segregation of duties. Required evidence:

  • Access control policy defining roles and permissions
  • MFA implementation logs for administrative and sensitive accounts
  • Quarterly access reviews with approval and revocation records
  • Privileged access management (PAM) tool logs and session recordings

Data Protection and Privacy

Institutions handling personal data must comply with both SAMA CSF and the Saudi Personal Data Protection Law (PDPL). Evidence includes:

  • Data protection impact assessments (DPIA) for new systems
  • Encryption standards and key management procedures
  • Data retention and disposal policies with execution records
  • Consent and privacy notice documentation

Incident Response and Breach Notification

SAMA requires a documented incident response plan, tabletop exercises, and timely breach reporting to SAMA and affected parties. Evidence includes:

  • Incident response plan with defined roles, escalation, and communication procedures
  • Annual tabletop exercise reports and lessons-learned documentation
  • Incident logs with detection time, containment actions, and resolution
  • Breach notification records and SAMA reporting submissions

Business Continuity and Disaster Recovery

Institutions must maintain recovery time objectives (RTO) and recovery point objectives (RPO) aligned with SAMA expectations. Evidence includes:

  • Business continuity and disaster recovery plans with defined RTOs and RPOs
  • Annual recovery testing reports with results and remediation tracking
  • Backup verification logs and restoration test records
  • Third-party service continuity agreements and audit reports

Documentation and Audit Readiness

SAMA conducts on-site and off-site examinations. Institutions should maintain:

  • A centralized compliance evidence repository, organized by domain and control
  • Version-controlled policies with approval dates and review schedules
  • System logs and monitoring data retained per SAMA retention requirements
  • Third-party audit reports (SOC 2, ISO 27001 certification, penetration tests)
  • A compliance calendar tracking control testing and evidence refresh cycles

Effective SAMA CSF compliance requires continuous monitoring, regular testing, and transparent documentation. Security leaders should treat the framework not as a checkbox exercise, but as a foundation for a mature, resilient cybersecurity posture that protects customer data and financial system stability.