Understanding SAMA's Current Cyber Security Framework

The Saudi Arabian Monetary Authority (SAMA) Cyber Security Framework establishes baseline and advanced security requirements for all licensed financial institutions operating within Saudi Arabia. The framework aligns with international standards—including ISO/IEC 27001:2022 and NIST Cybersecurity Framework 2.0—while reflecting local regulatory expectations and the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC).

SAMA's expectations centre on five core pillars: governance and risk management, technical controls, operational resilience, incident response and recovery, and third-party risk management. Compliance is not optional; institutions face escalating penalties for gaps, from corrective action notices to licence restrictions.

Governance and Risk Management: The Foundation

SAMA requires documented cybersecurity governance at board and executive level. This means:

  • A formal cybersecurity policy approved by the board, reviewed annually and updated to reflect emerging threats.
  • A Chief Information Security Officer (CISO) or equivalent role with direct reporting lines to senior management.
  • A risk register that identifies, assesses and prioritises cyber risks, linked to business impact.
  • Evidence of board oversight: meeting minutes, risk dashboards and quarterly cybersecurity status reports.

How to evidence it: Maintain a governance charter signed by the board. Document all policy reviews with dates and version control. Create a risk assessment matrix aligned to your institution's critical assets and regulatory obligations under the Saudi Personal Data Protection Law (PDPL) and sector-specific rules.

Technical Controls and Asset Management

SAMA mandates inventory and classification of all information assets, from customer databases to operational technology. Institutions must apply controls proportionate to risk:

  • Access controls: role-based access, multi-factor authentication for privileged accounts, and quarterly access reviews.
  • Encryption: data at rest and in transit, with key management procedures documented and tested.
  • Vulnerability management: regular scans, patch management timelines (critical patches within 30 days, typically), and remediation tracking.
  • Network segmentation: segregation of customer-facing systems, payment networks and administrative zones.

How to evidence it: Use a configuration management database (CMDB) to track all systems and their security status. Maintain vulnerability scan reports with remediation dates. Document patch deployment schedules and exceptions (with risk acceptance sign-offs). Conduct annual penetration tests and retain reports. Implement Security Information and Event Management (SIEM) to log and alert on suspicious activity.

Incident Response and Business Continuity

SAMA requires a documented incident response plan, tested at least annually. The plan must define:

  • Roles and responsibilities during an incident (incident commander, technical team, communications lead).
  • Detection and escalation procedures, including thresholds for notifying SAMA.
  • Recovery time objectives (RTO) and recovery point objectives (RPO) for critical services.
  • Notification procedures for affected customers, aligned with PDPL breach notification requirements.

How to evidence it: Conduct tabletop exercises and full simulations annually; document findings and corrective actions. Maintain a log of all incidents (even minor ones) with timelines, root causes and remediation steps. Test backup and recovery procedures quarterly. Retain evidence of SAMA notifications if incidents occur.

Third-Party and Supply Chain Risk

SAMA expects institutions to assess and monitor vendors, cloud providers and critical service providers. This includes due diligence before engagement and ongoing compliance monitoring.

How to evidence it: Create a vendor risk assessment questionnaire covering security, data protection and business continuity. Maintain a vendor register with assessment dates and renewal schedules. Request annual security attestations (SOC 2 Type II reports, ISO 27001 certificates) and review them. Document contractual clauses requiring compliance with SAMA expectations.

Preparing for SAMA Examinations

SAMA conducts on-site and off-site examinations. Auditors will request evidence of controls through documentation, interviews and system demonstrations. Prepare by:

  • Centralising all compliance evidence in a secure repository with version control.
  • Training staff on their roles in cybersecurity (not just IT teams—all staff must understand data protection and incident reporting).
  • Conducting an internal audit against the SAMA framework before formal examination.
  • Maintaining a continuous improvement log that shows how gaps are being addressed.

Meeting SAMA's Cyber Security Framework is both a regulatory requirement and a business imperative. Institutions that embed these controls into daily operations—rather than treating compliance as a box-ticking exercise—build resilience against real threats and earn customer trust.