Understanding SAMA's Current Cyber Security Framework

The Saudi Arabian Monetary Authority (SAMA) Cyber Security Framework establishes a comprehensive set of requirements that apply to all financial institutions operating under SAMA's regulatory authority. Unlike prescriptive checklists, the framework is principle-based, requiring organizations to demonstrate how they identify, protect, detect, respond to, and recover from cyber threats in alignment with their risk profile and business context.

The framework aligns closely with international standards including NIST CSF 2.0 and ISO/IEC 27001:2022, while incorporating Saudi Arabia's regulatory environment and the National Cybersecurity Authority's (NCA) Enterprise Cybersecurity Center (ECC) guidance. This convergence means that evidence of compliance with one framework often supports compliance with others.

Core Evidence Requirements

Risk Assessment and Governance Documentation

SAMA expects financial institutions to maintain documented enterprise-wide cyber risk assessments updated at least annually, or more frequently if material changes occur. Evidence should include:

  • Board-approved cyber risk strategy and appetite statements
  • Documented asset inventories (systems, data, applications, infrastructure)
  • Threat and vulnerability assessments specific to your operating environment
  • Risk register showing identified risks, controls, residual risk ratings, and remediation timelines
  • Board and audit committee meeting minutes demonstrating oversight and escalation

This governance layer is critical: SAMA views cyber risk management as a board-level responsibility, not solely an IT function. Your evidence must show that senior leadership actively monitors and approves cyber strategy.

Control Inventory and Implementation Evidence

Organizations must maintain a comprehensive control matrix mapping SAMA framework requirements to implemented controls. For each control, evidence should demonstrate:

  • Design documentation (policies, procedures, technical specifications)
  • Implementation evidence (configuration screenshots, access logs, system settings)
  • Testing results (penetration tests, vulnerability scans, control effectiveness assessments)
  • Remediation records for identified gaps or failures
  • Change management logs showing control updates and approvals

SAMA auditors will request evidence that controls are not merely documented but actively functioning. Configuration management databases (CMDBs), security information and event management (SIEM) logs, and third-party assessment reports form the backbone of this evidence.

Incident Response and Business Continuity

The framework requires documented incident response plans tested at least annually. Evidence should include:

  • Incident response procedures approved by management
  • Tabletop exercise or simulation results demonstrating team readiness
  • Incident logs from the past 12 months showing detection, response, and resolution timelines
  • Business continuity and disaster recovery plans with documented recovery time objectives (RTOs) and recovery point objectives (RPOs)
  • Records of disaster recovery drills and their outcomes

Third-Party and Supply Chain Risk

SAMA expects evidence that cyber risks from vendors, service providers, and critical suppliers are actively managed. Maintain:

  • Vendor risk assessment questionnaires and security certifications (ISO/IEC 27001, SOC 2, etc.)
  • Service-level agreements (SLAs) with defined security and availability standards
  • Audit reports or assessments of critical third parties
  • Incident logs involving third-party systems or data breaches

Continuous Monitoring and Reporting

SAMA requires ongoing evidence of control effectiveness. Organizations should maintain:

  • Monthly or quarterly control testing reports
  • Security metrics dashboards showing key risk indicators (KRIs) and key performance indicators (KPIs)
  • Vulnerability management reports with remediation timelines
  • Access review and recertification records
  • Regulatory change logs ensuring framework updates are incorporated

This evidence should be aggregated into a compliance status report reviewed by the board at least semi-annually.

Alignment with PDPL and NCA ECC Guidance

Saudi Arabia's Personal Data Protection Law (PDPL) and NCA's ECC guidance add complementary requirements. Evidence of PDPL compliance (data protection impact assessments, consent records, breach notification logs) and NCA ECC alignment (threat intelligence integration, incident reporting to authorities) strengthen your SAMA compliance posture.

Practical Next Steps

If your organization lacks comprehensive evidence, prioritize: (1) documenting your current risk assessment and control inventory; (2) establishing a centralized compliance repository accessible to auditors; (3) scheduling annual control testing and board reviews; (4) integrating SAMA requirements into your enterprise risk management process.

SAMA's framework is not a one-time compliance exercise but an ongoing management discipline. Security leaders who view evidence-gathering as part of continuous improvement—rather than audit preparation—build more resilient and defensible cyber programs.