Understanding SAMA's Current Framework Expectations

The Saudi Central Bank (SAMA) Cyber Security Framework remains the primary regulatory standard for financial institutions operating in the Kingdom. Unlike prescriptive checklists, SAMA's framework establishes outcome-focused requirements across five core pillars: governance and risk management, security architecture, operational resilience, third-party risk, and incident response. Compliance is not a one-time audit but a continuous demonstration of control effectiveness.

Financial institutions must align their cyber programmes with both SAMA expectations and the National Cybersecurity Authority's (NCA) Essential Cyber Controls (ECC), which provide practical implementation guidance. The NCA ECC framework complements SAMA by offering detailed control narratives and evidence standards that regulators and auditors now routinely reference.

Core Pillars and Evidence Requirements

Governance and Board Oversight

SAMA expects boards and senior management to own cyber risk as a business risk, not an IT function. Evidence must include:

  • Board-approved cyber risk policy and strategy, refreshed annually and aligned with business objectives
  • Documented cyber risk appetite statement with measurable tolerance thresholds
  • Board meeting minutes showing regular cyber risk reporting (minimum quarterly)
  • Cyber risk committee charter with clear accountability and escalation paths
  • Third-party audit reports confirming governance maturity against SAMA benchmarks

Risk Assessment and Asset Management

Institutions must maintain a current inventory of critical systems, data, and dependencies. SAMA expects:

  • Annual enterprise-wide cyber risk assessments using recognised methodologies (NIST CSF 2.0, ISO/IEC 27001:2022)
  • Asset classification matrices aligned to data sensitivity and business criticality
  • Business continuity and disaster recovery plans tested annually with documented results
  • Supply chain risk registers identifying third-party dependencies and mitigation controls

Technical Controls and Detection

SAMA mandates a layered security posture. Evidence includes:

  • Network segmentation architecture diagrams and firewall rule documentation
  • Multi-factor authentication deployment across all critical systems and remote access
  • Endpoint detection and response (EDR) or equivalent monitoring across all devices
  • Security information and event management (SIEM) logs retained for minimum 90 days
  • Penetration testing and vulnerability assessment reports (minimum annual, more frequent for critical systems)
  • Encryption standards for data in transit and at rest, with key management policies

Incident Response and Resilience

SAMA requires tested, documented incident response capability:

  • Incident response plan with defined roles, contact lists, and escalation procedures
  • Tabletop exercises or simulations conducted at least semi-annually, with outcomes documented
  • Incident logs showing detection, containment, and remediation timelines
  • Post-incident reviews identifying root causes and control improvements
  • Notification procedures aligned with NCA and PDPL requirements for personal data breaches

Practical Compliance Roadmap

Establish a Compliance Baseline: Conduct a gap analysis against SAMA CSF and NCA ECC. Document current state for each control domain.

Create an Evidence Repository: Centralise policy documents, audit reports, test results, and logs in a secure, version-controlled system. Use a control matrix linking each SAMA requirement to supporting evidence.

Implement Continuous Monitoring: Move beyond annual audits. Use automated tools to track control effectiveness monthly. Report metrics to the board quarterly.

Engage Third-Party Auditors: Annual independent assessments by SAMA-recognised auditors strengthen credibility. Ensure auditors specifically validate evidence against current SAMA and NCA standards.

Train and Embed Accountability: Assign control ownership to specific teams. Document training records showing staff understand their cyber responsibilities.

Key Takeaway

SAMA compliance is demonstrated through documented, tested, and continuously monitored controls—not compliance theatre. Financial institutions that treat cyber security as a strategic business function, maintain clear evidence trails, and align with both SAMA and NCA guidance will satisfy current regulatory expectations and build resilience against evolving threats.