Understanding SAMA's Current Cyber Security Framework

The Saudi Arabian Monetary Authority (SAMA) Cyber Security Framework establishes the baseline security posture required of all financial institutions, banks, and payment service providers operating in the Kingdom. The framework aligns with internationally recognized standards—particularly NIST Cybersecurity Framework 2.0 and ISO/IEC 27001:2022—while incorporating the specific regulatory environment of Saudi Arabia, including the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.

SAMA's framework is organized around five core functions: Govern, Protect, Detect, Respond, and Recover. Each function contains specific objectives and outcomes that institutions must address through policy, process, and technology.

Key Compliance Pillars and Evidence Requirements

1. Governance and Risk Management

SAMA expects documented cybersecurity governance structures, including:

  • Board-level cyber risk oversight and accountability
  • Written cybersecurity strategy aligned with business objectives
  • Risk assessment and treatment plans covering all critical assets
  • Third-party and supply-chain risk management policies
  • Incident response and business continuity plans tested annually

Evidence: Board minutes, governance charters, risk registers, audit reports, and signed attestations from senior management.

2. Asset and Access Management

Institutions must maintain an authoritative inventory of information assets and enforce identity and access controls:

  • Complete asset inventory (hardware, software, data, cloud services)
  • Role-based access control (RBAC) with least-privilege enforcement
  • Multi-factor authentication (MFA) for all remote and privileged access
  • Regular access reviews and deprovisioning procedures

Evidence: Configuration management databases (CMDB), access control matrices, MFA logs, quarterly access review sign-offs, and privileged account management (PAM) audit trails.

3. Data Protection and Privacy

Compliance with the Saudi PDPL requires:

  • Data classification and handling procedures
  • Encryption of data in transit and at rest
  • Data retention and secure disposal policies
  • Privacy impact assessments for new systems
  • Breach notification procedures aligned with PDPL timelines

Evidence: Data classification matrices, encryption inventory, disposal certificates, privacy impact assessment records, and breach notification logs.

4. Threat Detection and Monitoring

SAMA mandates continuous security monitoring:

  • Security Operations Center (SOC) or managed SOC services
  • Log aggregation and centralized event monitoring
  • Intrusion detection/prevention systems (IDS/IPS)
  • Vulnerability scanning and patch management programs
  • Security awareness and phishing simulation campaigns

Evidence: SOC operational procedures, SIEM dashboards and alert configurations, vulnerability scan reports, patch deployment records, and training completion metrics.

5. Incident Response and Recovery

Documented and tested incident management capabilities:

  • Incident response plan with defined roles and escalation paths
  • Annual tabletop exercises and simulations
  • Disaster recovery and business continuity plans with recovery time objectives (RTOs)
  • Regular backup and restoration testing

Evidence: Incident response procedures, exercise reports with findings and remediation tracking, backup test logs, and recovery time validation records.

Demonstrating Compliance in Practice

Effective evidence gathering requires:

  • Documentation: Maintain current, version-controlled policies and procedures; ensure board and management sign-off
  • Automation: Use SIEM, vulnerability management, and configuration management tools to generate audit-ready logs and reports
  • Third-Party Validation: Engage independent auditors for annual assessments; consider ISO/IEC 27001 certification to demonstrate systematic controls
  • Continuous Improvement: Track control effectiveness through metrics; remediate gaps promptly and document corrective actions

Alignment with Broader Regulatory Landscape

SAMA's framework complements other Saudi regulations: the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC) for critical infrastructure, and sector-specific requirements from the Saudi Central Bank for payment systems. Institutions should map their controls to all applicable standards to avoid redundancy and ensure comprehensive coverage.

By adopting a structured, evidence-based approach to SAMA compliance, financial institutions strengthen their security posture while demonstrating accountability to regulators and stakeholders.