SAMA's Cyber Security Framework: The Current Landscape

The Saudi Arabian Monetary Authority (SAMA) has established a comprehensive Cyber Security Framework that aligns with international standards while reflecting the Kingdom's regulatory priorities. Financial institutions operating in Saudi Arabia must now demonstrate compliance through structured, documented evidence rather than assertion alone. This shift toward accountability-based regulation requires security leaders to build demonstrable control environments.

Core Pillars and Control Domains

SAMA's framework organizes cyber security into five principal domains: governance and risk management, asset management, access control and identity management, detection and response, and resilience and business continuity. Each domain carries specific control objectives that institutions must evidence through policies, procedures, logs, and audit trails.

Governance and Risk Management requires documented board oversight, a defined cyber risk strategy, and regular risk assessments. Evidence includes board minutes, cyber risk registers, and annual risk review documentation. Institutions must show that cyber risk is integrated into enterprise risk management, not siloed within IT.

Asset Management demands a complete inventory of critical systems and data, classification schemes, and lifecycle management controls. Security leaders should maintain asset registers, data flow diagrams, and records of regular inventory audits to evidence this control.

Access Control and Identity Management expects role-based access policies, multi-factor authentication for sensitive systems, and regular access reviews. Auditable evidence includes access control matrices, authentication logs, and documented quarterly or semi-annual access certification sign-offs.

Detection and Response requires a Security Operations Centre (SOC) or equivalent monitoring capability, incident response procedures, and regular testing. Evidence includes SOC logs, incident response playbooks, tabletop exercise records, and breach notification documentation.

Resilience and Business Continuity mandates backup and recovery strategies, disaster recovery testing, and supply chain risk management. Evidence includes backup verification logs, disaster recovery test reports, and vendor risk assessments.

Alignment with NCA ECC and PDPL

SAMA's framework complements the National Cybersecurity Authority's Essential Cyber Controls (NCA ECC) and the Saudi Personal Data Protection Law (PDPL). Institutions must evidence controls that satisfy all three regulatory regimes. For example, data protection impact assessments (DPIAs) and consent records evidence PDPL compliance while also supporting SAMA's asset and access management requirements.

Building an Evidence-Ready Control Environment

To meet SAMA expectations, institutions should adopt a continuous documentation approach. Implement centralized logging and SIEM (Security Information and Event Management) solutions that create auditable trails of control execution. Automate policy enforcement where possible—for instance, using identity and access management (IAM) platforms to enforce role-based access policies and generate compliance reports automatically.

Conduct regular internal audits and gap assessments against the SAMA framework. Document remediation plans with timelines and ownership. Maintain a control effectiveness register that tracks the design and operating effectiveness of each control through testing records, audit results, and management certifications.

Third-party and supply chain risk must also be evidenced. Maintain vendor risk assessments, security addendums to contracts, and periodic vendor audit reports. SAMA expects visibility into the security posture of critical service providers.

Practical Next Steps

Security leaders should prioritize mapping existing controls to SAMA's framework domains. Identify evidence gaps and establish a remediation roadmap. Invest in tools and processes that generate audit trails automatically—manual documentation is labor-intensive and prone to inconsistency. Engage internal audit and compliance teams early to align on evidence standards and testing frequency.

Schedule regular reviews with the board and senior management to demonstrate control maturity and risk trends. This demonstrates governance alignment and supports SAMA's expectation that cyber security is a business-led, not purely technical, discipline.

Compliance with SAMA's Cyber Security Framework is not a one-time exercise but an ongoing commitment to building resilience and accountability. The institutions that invest now in structured evidence and continuous control improvement will navigate regulatory scrutiny more effectively and build stakeholder confidence in their security posture.