Understanding SAMA's Cyber Security Framework Scope

The Saudi Arabian Monetary Authority (SAMA) Cyber Security Framework establishes baseline and advanced security controls for all financial institutions operating in the Kingdom, including banks, insurance firms, fintech operators, and payment service providers. The framework aligns with international standards such as ISO/IEC 27001:2022 and NIST Cybersecurity Framework 2.0, while embedding Saudi regulatory context and the obligations under the Saudi Personal Data Protection Law (PDPL).

Financial institutions must now demonstrate that controls are not merely implemented, but continuously operated, monitored, and improved. Regulators expect evidence—not promises.

Core Pillars of SAMA Compliance Evidence

1. Governance and Risk Management

SAMA requires documented governance structures that show:

  • Board-level cyber risk oversight and regular reporting (at least quarterly)
  • A Chief Information Security Officer (CISO) with clear mandate and accountability
  • Cyber risk appetite statements and risk tolerance thresholds
  • Evidence of cyber risk assessments aligned with enterprise risk management
  • Incident response plans tested annually with documented results

Maintain board minutes, CISO appointment letters, risk registers, and assessment reports as primary evidence. These must be dated, signed, and retained for audit trails.

2. Technical and Operational Controls

SAMA expects implementation of controls across:

  • Access Control: Role-based access control (RBAC) policies, multi-factor authentication (MFA) for all privileged accounts, and periodic access reviews with sign-off
  • Data Protection: Encryption in transit and at rest, data classification matrices, and evidence of secure deletion procedures
  • Network Security: Firewalls, intrusion detection/prevention systems (IDS/IPS), network segmentation, and DMZ configurations with configuration baselines
  • Endpoint Security: Endpoint Detection and Response (EDR) deployment, patch management schedules, and vulnerability scanning reports
  • System Monitoring: Security Information and Event Management (SIEM) logs retained for minimum 12 months, with documented alerting and escalation procedures

Evidence includes configuration files, policy documents, system screenshots, log extracts, and third-party attestation reports (e.g., SOC 2 Type II for service providers).

3. Compliance with the Saudi PDPL

The PDPL imposes specific data handling obligations that SAMA audits expect to see embedded in cyber controls:

  • Data processing agreements with all third parties and processors
  • Data subject rights fulfillment procedures (access, correction, deletion requests)
  • Privacy impact assessments for new systems or processing activities
  • Breach notification logs and evidence of timely reporting to the National Cybersecurity Authority (NCA)
  • Retention schedules showing when personal data is deleted

4. Incident Management and Reporting

SAMA mandates reporting of security incidents to the NCA within defined timeframes. Evidence must include:

  • Incident logs with timestamps, classification, and severity levels
  • Root cause analysis reports
  • Remediation plans and closure evidence
  • NCA notification records and any follow-up correspondence

Building an Audit-Ready Evidence Repository

Establish a centralized compliance evidence repository that organizes:

  • Policy Library: All cybersecurity, data protection, and incident response policies, versioned and dated
  • Assessment Records: Vulnerability assessments, penetration test reports, risk assessments, and compliance audits
  • Training Evidence: Security awareness training completion records, phishing simulation results, and role-specific training logs
  • Audit Trails: System logs, access logs, configuration change logs, and administrative action logs
  • Third-Party Attestations: SOC 2, ISO 27001 certificates, and vendor security assessments

Use a document management system with version control, retention policies, and access controls. Ensure all evidence is retrievable within 48 hours of a regulator request.

Key Takeaway for Security Leaders

SAMA compliance is not a one-time certification exercise—it is continuous demonstration of a mature security posture. Start by mapping your current state against the SAMA framework, identify gaps, prioritize remediation, and build evidence collection into your operational rhythm. Regular internal audits, quarterly board reviews, and annual third-party assessments will keep your institution audit-ready and aligned with evolving regulatory expectations in the Kingdom.