Understanding SAMA's Cyber Security Framework Expectations

The Saudi Central Bank (SAMA) Cyber Security Framework represents the primary regulatory baseline for financial institutions operating in the Kingdom. Unlike prescriptive checklists, the framework establishes principles-based governance, risk management, and technical control domains that institutions must operationalize and evidence continuously.

SAMA's expectations align with international standards—particularly ISO/IEC 27001:2022 and NIST Cybersecurity Framework 2.0—while reflecting Saudi Arabia's regulatory priorities under the Personal Data Protection Law (PDPL) and the National Cybersecurity Authority (NCA) guidance. Financial institutions must demonstrate that controls are not merely in place, but measurable, tested, and continuously improved.

Core Framework Pillars and Evidence Requirements

1. Governance and Risk Management

SAMA requires documented governance structures with clear accountability for cybersecurity. Evidence includes:

  • Board-level cybersecurity oversight policies and meeting minutes
  • Formal risk assessment reports aligned to the institution's risk appetite
  • Risk register maintained and reviewed quarterly, with documented remediation timelines
  • Third-party risk management framework covering vendors, cloud providers, and outsourced services
  • Business continuity and disaster recovery plans tested annually with documented results

Security leaders must maintain a control matrix mapping each SAMA requirement to specific policies, procedures, and technical controls. This matrix becomes the foundation for audit trails and regulatory reporting.

2. Access Control and Identity Management

SAMA mandates strong authentication, least-privilege access, and segregation of duties. Evidence requirements include:

  • Multi-factor authentication (MFA) implementation logs across critical systems
  • Privileged access management (PAM) audit trails showing who accessed what, when, and why
  • Quarterly access reviews with documented approval and removal of obsolete accounts
  • Role-based access control (RBAC) policies aligned to job functions
  • Segregation of duties matrices preventing conflicting permissions

3. Data Protection and Encryption

Under both SAMA and the PDPL, personal and financial data must be protected in transit and at rest. Document:

  • Data classification policy with inventory of sensitive assets
  • Encryption standards (TLS 1.2 or higher for transit; AES-256 or equivalent for rest)
  • Key management procedures and audit logs from hardware security modules (HSMs)
  • Data retention and secure deletion procedures with compliance certificates

4. Incident Response and Threat Detection

SAMA expects institutions to detect, respond to, and report cyber incidents. Evidence includes:

  • Security Operations Center (SOC) or equivalent monitoring with alert tuning and baseline metrics
  • Incident response plan with defined roles, escalation paths, and communication protocols
  • Incident logs documenting detection time, response actions, and resolution
  • Mandatory reporting to NCA within required timeframes, with evidence of notification
  • Post-incident reviews and lessons-learned documentation

5. Vulnerability Management and Patch Management

Continuous vulnerability assessment and timely remediation are non-negotiable. Maintain:

  • Vulnerability scanning schedules and reports with risk ratings
  • Patch management policy with defined SLAs (e.g., critical patches within 30 days)
  • Penetration testing results and remediation tracking
  • Configuration baselines and compliance scanning reports

Practical Steps to Evidence Compliance

Implement a control tracking system: Use a centralized platform (GRC tool, spreadsheet, or specialized software) to map each SAMA requirement to evidence artifacts. Assign ownership and track remediation status.

Establish audit trails: Ensure all critical systems generate and retain logs (minimum 12 months). Configure log aggregation and retention in alignment with PDPL and SAMA expectations.

Schedule regular assessments: Conduct annual internal audits and engage external auditors familiar with SAMA requirements. Use assessment findings to refine controls.

Document policy and procedure updates: Maintain version-controlled policies with approval dates and evidence of staff training and acknowledgment.

Prepare for regulatory examinations: SAMA conducts on-site and off-site examinations. Organize evidence by framework pillar, ensure key personnel understand the control environment, and be ready to demonstrate live system functionality.

Alignment with Broader Regulatory Expectations

SAMA's framework does not exist in isolation. Financial institutions must also satisfy NCA cybersecurity directives, PDPL compliance obligations, and industry-specific standards like PCI DSS 4.0 (if handling payment cards). A unified compliance approach—mapping all frameworks to a single control architecture—reduces redundancy and strengthens overall posture.

By treating evidence collection as an ongoing operational practice rather than a year-end compliance exercise, security leaders can demonstrate maturity, reduce audit friction, and genuinely lower organizational risk.