Understanding SAMA's Current Cyber Security Framework

The Saudi Central Bank (SAMA) Cyber Security Framework represents the Kingdom's foundational standard for financial sector resilience. Unlike advisory guidelines, SAMA's framework is mandatory for all banks, insurance companies, and other financial institutions regulated by SAMA. Compliance is not optional—it is a regulatory obligation enforced through periodic examinations and on-site inspections.

The framework aligns with international best practice, including ISO/IEC 27001:2022 principles and NIST Cybersecurity Framework 2.0 concepts, while reflecting the specific risk environment and regulatory expectations of the Saudi financial system. SAMA expects institutions to move beyond checkbox compliance toward a risk-informed, outcomes-focused security posture.

Key Pillars and Evidence Requirements

Governance and Risk Management

SAMA mandates a Board-level cybersecurity committee with clear accountability. Evidence must include:

  • Board meeting minutes documenting cybersecurity agenda items and decisions
  • Approved cybersecurity strategy and risk management policy
  • Annual risk assessments aligned with business objectives
  • Incident response and business continuity plans tested at least annually
  • Third-party risk assessments for critical service providers

Institutions must document that governance structures are not theoretical. SAMA auditors examine whether the Board actually receives quarterly cyber risk reports, whether risk appetite is formally defined, and whether budget allocation reflects stated priorities.

Technical Controls and Asset Management

SAMA requires documented inventory of all critical systems and data assets. Evidence includes:

  • Authoritative asset registers (hardware, software, cloud services, APIs) with ownership and classification
  • Configuration baselines and deviation logs
  • Patch management records showing timely application of security updates
  • Access control matrices and privileged account audits
  • Encryption implementation records for data at rest and in transit

Passive documentation is insufficient. SAMA expects continuous monitoring logs, automated compliance scanning results, and evidence that non-compliance triggers corrective action within defined timeframes.

Incident Detection and Response

The framework requires a Security Operations Center (SOC) capability proportionate to institutional size and risk profile. Evidence must demonstrate:

  • Security event logging and log retention (typically 12 months minimum)
  • Alert tuning and false-positive reduction metrics
  • Incident response playbooks and tabletop exercise results
  • Post-incident reviews documenting root cause and remediation
  • Notification procedures aligned with SAMA reporting timelines

SAMA expects institutions to report significant cyber incidents within 24 hours. Institutions must maintain evidence of detection time, escalation procedures, and communication with regulators.

Personnel Security and Awareness

SAMA mandates security awareness training and background vetting. Evidence includes:

  • Training completion records and assessment scores
  • Phishing simulation results and remedial training for high-risk users
  • Background checks for employees with privileged access
  • Offboarding procedures and access removal logs

Alignment with Saudi Data Protection Law and NCA Standards

The Saudi Personal Data Protection Law (PDPL) and National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC) create overlapping obligations. Evidence of SAMA compliance should integrate:

  • Data protection impact assessments for new systems
  • Consent and data subject rights management processes
  • NCA ECC compliance mapping (particularly for critical infrastructure)

Practical Steps for Evidence Management

Document Everything: Maintain a compliance evidence repository organized by framework pillar. Use version control and date all records.

Automate Collection: Deploy Security Information and Event Management (SIEM) and configuration management tools to generate audit trails continuously. Manual evidence gathering is error-prone and does not demonstrate real-time compliance.

Conduct Internal Audits: Perform quarterly self-assessments against SAMA requirements. Identify gaps before regulators do.

Engage Third Parties: Commission independent assessments by auditors familiar with SAMA expectations. External validation strengthens your compliance posture.

Maintain Audit Trails: Preserve logs of all compliance activities—policy updates, training records, incident responses, and remediation efforts. These form the evidence chain regulators expect.

Conclusion

SAMA compliance is not a one-time project. It requires continuous monitoring, documented governance, and demonstrable risk management. Security leaders must shift from reactive incident response to proactive evidence building, ensuring every control is not only implemented but also auditable and continuously monitored. The institutions that succeed are those that embed compliance into operational processes, making evidence generation automatic rather than retrospective.