Understanding SAMA CSF Governance Expectations

The Saudi Arabian Monetary Authority's Cyber Security Framework (SAMA CSF) establishes a risk-based, proportionate control environment for all financial institutions and regulated entities. Unlike prescriptive checklists, SAMA CSF aligns with the National Cybersecurity Authority's Essential Cybersecurity Controls (NCA ECC) and the Saudi Personal Data Protection Law (PDPL), creating an integrated compliance landscape that security leaders must navigate carefully.

The framework's governance pillar requires board-level accountability, defined roles, and documented cyber risk policies. To evidence this, organizations must maintain:

  • Board-approved cyber risk strategy and tolerance statements, reviewed at least annually
  • Formal appointment and charter of a Chief Information Security Officer (CISO) or equivalent, with direct reporting line to executive leadership
  • Cyber risk committee minutes demonstrating oversight of material incidents, control assessments, and third-party risks
  • Documented information security policies covering access control, data classification, and incident response

Technical Resilience and Control Evidence

SAMA CSF's technical domain mirrors ISO/IEC 27001:2022 and NCA ECC principles: asset management, access control, cryptography, and network segmentation. Auditors and SAMA examiners expect organizations to evidence controls through:

  • Asset inventories maintained in a centralized Configuration Management Database (CMDB), updated quarterly and reconciled to financial systems
  • Access control matrices showing role-based access, segregation of duties, and privileged access management (PAM) logs reviewed monthly
  • Encryption standards documented for data at rest and in transit, with key rotation policies and hardware security module (HSM) deployment records
  • Vulnerability assessments performed at least semi-annually, with remediation timelines and executive sign-off on accepted risks
  • Penetration testing reports from qualified third parties, demonstrating remediation of critical findings

Incident Response and Business Continuity

SAMA CSF mandates incident response plans tested at least annually and business continuity arrangements validated through tabletop exercises or full simulations. Evidence includes:

  • Incident response playbooks covering detection, containment, eradication, and recovery, with defined escalation thresholds
  • Security Operations Center (SOC) or managed security service provider (MSSP) logs showing 24/7 monitoring and alert response times
  • Incident register documenting all material events, root causes, and remediation actions, shared with board quarterly
  • Business continuity test results, including Recovery Time Objective (RTO) and Recovery Point Objective (RPO) validations
  • Notification procedures aligned with PDPL breach reporting timelines (72 hours to the NCA for personal data incidents)

Third-Party Risk and Supplier Management

SAMA CSF extends accountability to vendors, cloud providers, and outsourced service providers. Organizations must evidence:

  • Vendor risk assessment questionnaires aligned with NCA ECC and PDPL requirements
  • Service-level agreements (SLAs) specifying security obligations, audit rights, and data handling practices
  • Annual third-party security audits (SOC 2 Type II, ISO/IEC 27001:2022, or equivalent) for critical suppliers
  • Contractual provisions for incident notification, data deletion, and regulatory cooperation

Building a Sustainable Compliance Program

Effective SAMA CSF compliance is not a one-time audit exercise. Organizations should establish a continuous monitoring and assurance program that includes quarterly self-assessments, annual independent audits by external auditors, and regular SAMA examinations. Maintain a centralized compliance repository—a secure, version-controlled repository of all policies, risk assessments, test results, and incident records—accessible to internal audit, external auditors, and SAMA examiners.

Security leaders who treat SAMA CSF as a living, integrated framework—rather than a compliance checkbox—build resilience, reduce breach risk, and demonstrate mature governance to regulators and stakeholders.