Understanding SAMA CSF Expectations

The Saudi Arabian Monetary Authority's Cyber Security Framework (SAMA CSF) establishes mandatory security requirements for all financial institutions operating in the Kingdom. Unlike advisory frameworks, SAMA CSF is a regulatory obligation enforced through regular examinations and compliance assessments. Financial institutions must align their security posture with five core pillars: governance and risk management, technical controls, operational resilience, third-party risk management, and incident response and recovery.

SAMA CSF aligns with international standards including NIST Cybersecurity Framework 2.0 and ISO/IEC 27001:2022, while remaining tailored to the Saudi financial sector's specific risks and operational environment. Compliance is not a one-time certification but an ongoing demonstration of control effectiveness.

Core Governance and Risk Management Evidence

SAMA expects financial institutions to maintain documented governance structures that clearly assign cybersecurity accountability. This includes:

  • Board-level oversight: Board minutes and risk committee charters demonstrating regular cybersecurity discussions and strategic decisions.
  • Cybersecurity policy framework: Comprehensive, board-approved policies covering access control, data protection, incident response, and third-party management, with documented review cycles at least annually.
  • Risk assessment documentation: Annual or more frequent risk assessments identifying threats, vulnerabilities, and business impact, with evidence of remediation tracking and closure.
  • Roles and responsibilities: Organizational charts, job descriptions, and delegation matrices showing clear accountability for security functions.

Evidence must be verifiable through board resolutions, policy approval dates, and audit committee sign-offs. SAMA examiners will review meeting minutes to confirm that cybersecurity is treated as a strategic business matter, not solely an IT concern.

Technical Controls and Audit Trails

SAMA CSF mandates technical controls aligned with ISO/IEC 27001:2022 baseline protections. Evidence includes:

  • Access control logs: Centralized logging of user authentication, privilege escalation, and system access with retention periods meeting regulatory requirements (typically 12 months minimum).
  • Encryption implementation: Documentation of encryption standards applied to data in transit and at rest, with key management procedures and testing records.
  • Network segmentation: Architecture diagrams showing critical systems isolation, with firewall rules and network access control lists (NACLs) maintained and reviewed regularly.
  • Vulnerability management: Scan reports, patch deployment records, and remediation timelines demonstrating proactive identification and closure of security gaps.
  • Security monitoring: SOC (Security Operations Center) logs, alert thresholds, and incident response timelines showing 24/7 monitoring capability.

All technical evidence must be retained in a manner that survives regulatory examination. SAMA examiners will request and validate log integrity, configuration baselines, and change management records.

Third-Party and Vendor Risk Management

SAMA CSF requires documented assessment and ongoing monitoring of third-party service providers. Evidence includes:

  • Due diligence questionnaires and security assessments completed before contract signing.
  • Service Level Agreements (SLAs) with explicit cybersecurity and incident notification clauses.
  • Annual or periodic re-assessments of critical vendors, with documented remediation of any findings.
  • Audit rights and contractual clauses enabling the institution to verify vendor compliance.

Incident Response and Business Continuity

SAMA expects documented incident response plans with evidence of testing. Required documentation includes:

  • Incident response playbooks with defined escalation paths and notification procedures.
  • Business continuity and disaster recovery plans with documented testing results (tabletop exercises, simulations, or full failover tests).
  • Incident logs showing detection, investigation, containment, and closure timelines.
  • Post-incident reviews and lessons learned documentation.

Demonstrating Compliance to SAMA

Compliance evidence is typically presented through:

  • Annual compliance certifications: Management attestations supported by documented controls and test results.
  • Independent audits: Third-party assessments by SAMA-approved auditors validating control design and operating effectiveness.
  • Self-assessment reports: Detailed gap analyses and remediation roadmaps addressing any control weaknesses identified.
  • Regulatory examination responses: Timely, thorough responses to SAMA examination findings with evidence of corrective actions.

Security leaders should maintain a compliance evidence repository organized by SAMA CSF pillar, with clear ownership and regular updates. This approach reduces examination friction and demonstrates a mature, evidence-based security program aligned with regulatory expectations.

The bottom line: SAMA CSF compliance is not a checkbox exercise. It requires continuous documentation, testing, and improvement. Financial institutions that treat cybersecurity governance and evidence management as core operational practices will navigate SAMA examinations more effectively and build stronger, more resilient security programs.