SAMA Cyber Security Framework: Core Pillars and Current Expectations

The Saudi Central Bank (SAMA) Cyber Security Framework, aligned with international standards including ISO/IEC 27001:2022 and NIST CSF 2.0, mandates a risk-based approach to cybersecurity governance across all regulated financial institutions. As of 2024–2026, SAMA expects institutions to operate mature, documented security programs that address governance, risk management, technical controls, and incident response with measurable outcomes.

The Framework rests on five core pillars: Governance and Risk Management, Security Operations, Resilience and Business Continuity, Third-Party Risk Management, and Incident Response and Reporting. Each pillar carries specific control objectives and evidence requirements that SAMA examiners assess during compliance reviews.

Governance and Risk Management

SAMA requires a documented cybersecurity governance structure with clear roles, responsibilities, and accountability. Evidence must include:

  • Board-approved cybersecurity policy and strategy aligned with business objectives
  • Documented risk appetite statement and risk tolerance thresholds
  • Annual enterprise-wide cyber risk assessments (quantitative or qualitative) covering assets, threats, and vulnerabilities
  • Risk register with mitigation plans and executive sign-off
  • Evidence of board or audit committee oversight of cyber risk, including meeting minutes and management reports

Organizations must also maintain a current Information Security Policy that covers data classification, access controls, encryption standards, and compliance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations.

Security Operations and Technical Controls

SAMA expects institutions to implement baseline technical controls and demonstrate their effectiveness through logs, metrics, and audit trails. Key evidence includes:

  • Network segmentation and perimeter defense architecture diagrams with test results
  • Multi-factor authentication (MFA) deployment across critical systems and remote access
  • Encryption standards documentation (data at rest and in transit) compliant with SAMA guidelines
  • Vulnerability management program: scanning schedules, remediation timelines, and closure evidence
  • Security monitoring dashboards, SOC logs, and alert response records
  • Endpoint detection and response (EDR) or equivalent telemetry covering critical assets

Institutions must also evidence patch management discipline, privileged access management (PAM) controls, and segregation of duties in financial transaction processing.

Resilience and Business Continuity

SAMA mandates cyber resilience testing and documented recovery capabilities. Required evidence includes:

  • Business continuity and disaster recovery plans with cyber-specific scenarios
  • Annual tabletop exercises or simulations testing ransomware, data breach, and system outage scenarios
  • Recovery time objective (RTO) and recovery point objective (RPO) targets for critical systems
  • Backup and restore test results with documented recovery success rates
  • Resilience metrics tracked and reported to senior management

Third-Party Risk Management

Given the increasing reliance on fintech partners, cloud providers, and service providers, SAMA expects documented vendor risk assessment and ongoing monitoring. Evidence must demonstrate:

  • Vendor cybersecurity assessment questionnaires and due diligence documentation
  • Contractual security requirements and service level agreements (SLAs)
  • Annual or risk-based reassessment of critical third parties
  • Incident reporting requirements and breach notification timelines in contracts

Incident Response and Reporting

SAMA requires a documented incident response plan with evidence of testing and adherence. Required documentation includes:

  • Incident response plan with clear escalation procedures and contact information
  • Incident classification matrix and severity thresholds
  • Incident log with root cause analysis and remediation actions for all material incidents
  • Timely notification to SAMA for breaches affecting customer data or system availability
  • Post-incident review reports and lessons learned

Compliance Auditing and Continuous Improvement

SAMA expects institutions to conduct annual internal or external cybersecurity audits against the Framework. Evidence includes audit reports, management action plans, and closure documentation. Organizations should also maintain alignment with evolving standards such as ISO/IEC 42001 for AI governance and the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC) framework, which complements SAMA requirements.

Security leaders should maintain a centralized compliance repository with policies, assessments, test results, and management approvals readily available for SAMA examination. This disciplined approach to evidence collection not only satisfies regulatory expectations but strengthens the institution's overall cyber posture and resilience.