Understanding SAMA's Cyber Security Framework

The Saudi Central Bank (SAMA) Cyber Security Framework represents the regulatory baseline for all financial institutions operating in the Kingdom. Unlike prescriptive checklists, SAMA's expectations are outcome-focused: institutions must demonstrate that they have identified, managed, and mitigated cyber risk in line with their business model and threat environment. Compliance is not a one-time audit; it is continuous evidence of control effectiveness.

The framework aligns with international standards—particularly ISO/IEC 27001:2022 and NIST Cybersecurity Framework 2.0—but tailors requirements to the Saudi financial sector's unique regulatory and operational context. Financial institutions must treat cyber risk as a board-level concern and embed security into business strategy.

Core Governance and Accountability

SAMA expects documented evidence of cyber governance at three levels:

  • Board Oversight: Minutes and board papers showing quarterly cyber risk reviews, approval of cyber strategy, and accountability for incidents. Board members must understand the institution's cyber risk appetite and tolerance thresholds.
  • Executive Responsibility: A Chief Information Security Officer (CISO) or equivalent with direct reporting to the Chief Risk Officer or CEO, supported by a formal cybersecurity committee with cross-functional representation (IT, compliance, operations, legal).
  • Documented Policies: Written cybersecurity policies covering access control, data protection, incident response, supplier management, and business continuity. Policies must be reviewed and approved annually, with evidence of board sign-off.

Risk Assessment and Management

SAMA requires institutions to conduct annual cyber risk assessments that identify threats, vulnerabilities, and business impact. Evidence must include:

  • A comprehensive asset inventory (systems, data, applications) with classification by criticality.
  • Threat modeling specific to the financial sector (ransomware, data exfiltration, operational disruption).
  • Vulnerability scans and penetration tests performed by qualified third parties, with remediation tracking.
  • Risk registers showing residual risk, mitigation plans, and executive sign-off on accepted risks.

Documentation must demonstrate that risk assessment findings directly inform control investment and security budgeting decisions.

Technical and Operational Controls

SAMA expects evidence of preventive, detective, and corrective controls:

  • Access Control: Multi-factor authentication for all privileged accounts, role-based access policies, and quarterly access reviews with documented approval.
  • Data Protection: Encryption of sensitive data in transit and at rest, data loss prevention (DLP) tools, and logs of data access by privileged users.
  • Network Security: Firewalls, intrusion detection systems, and network segmentation with documented architecture diagrams.
  • Endpoint Security: Antivirus, patch management, and mobile device management with compliance reports showing patch currency.
  • Monitoring: A Security Operations Centre (SOC) or equivalent with 24/7 log aggregation, alerting, and incident triage. SAMA expects documented SOC procedures, escalation paths, and alert tuning to minimize false positives.

Incident Response and Resilience

SAMA mandates a tested incident response plan with evidence of:

  • Annual tabletop exercises simulating cyber incidents, with documented findings and remediation actions.
  • Business continuity and disaster recovery plans tested at least annually, with recovery time objectives (RTO) and recovery point objectives (RPO) aligned to business criticality.
  • Incident logs showing detection time, response time, containment, and root-cause analysis for all security events.
  • Breach notification procedures compliant with the Saudi Personal Data Protection Law (PDPL) and SAMA's incident reporting requirements.

Supplier and Third-Party Management

SAMA expects institutions to extend cyber governance to third-party service providers. Evidence must include:

  • Contracts with explicit cybersecurity requirements and audit rights.
  • Vendor risk assessments before onboarding and annually thereafter.
  • Audit reports or attestations (SOC 2 Type II, ISO 27001 certification) from critical suppliers.

Demonstrating Compliance

Effective evidence management requires a centralized repository—a cyber compliance dashboard or governance platform—that aggregates policies, assessments, test results, training records, and incident logs. This simplifies SAMA examinations and demonstrates institutional maturity.

Financial leaders should view SAMA's framework not as a regulatory burden but as a roadmap to resilience. Institutions that embed cyber governance into business operations, maintain rigorous documentation, and foster a security-aware culture will satisfy SAMA's expectations and protect stakeholder trust.