Understanding SAMA's Current Cyber Security Framework

The Saudi Central Bank (SAMA) Cyber Security Framework remains the cornerstone of financial-sector cybersecurity governance in the Kingdom. Unlike aspirational guidelines, SAMA's requirements are mandatory for all regulated financial institutions, including banks, payment service providers, and digital banking platforms. The framework aligns with international standards—notably NIST Cybersecurity Framework 2.0 and ISO/IEC 27001:2022—while embedding Saudi regulatory context and the principles of the Personal Data Protection Law (PDPL).

Security leaders must recognize that SAMA assessment teams evaluate not just the presence of controls, but the evidence of their operation. A documented policy without proof of enforcement carries minimal weight. This distinction separates organizations that pass regulatory scrutiny from those facing remediation notices.

Core Pillars and Evidence Requirements

Governance and Risk Management

SAMA expects a defined cyber risk governance structure: a board-level committee or equivalent, a Chief Information Security Officer (CISO) with clear authority, and documented risk appetite statements. Evidence includes:

  • Board meeting minutes reflecting cyber risk discussion and approval of cyber strategy
  • CISO appointment letter, job description, and reporting line to the board or audit committee
  • Annual cyber risk assessments aligned to business objectives, with sign-off by senior management
  • Risk registers showing threat identification, impact rating, and mitigation ownership

Asset and Access Management

SAMA requires comprehensive asset inventory and identity management. Leaders should maintain:

  • Authoritative asset register (hardware, software, data repositories) with ownership and criticality classification
  • Access control matrices showing role-based permissions, with quarterly attestation by business owners
  • Multi-factor authentication logs for privileged accounts, retained for audit trail purposes
  • Deprovisioning records proving timely removal of access when staff depart

Threat Detection and Incident Response

The framework mandates a Security Operations Center (SOC) function or equivalent monitoring capability. Essential evidence includes:

  • Baseline logs from firewalls, intrusion detection systems, and endpoint detection and response (EDR) tools, with retention aligned to PDPL (minimum two years for sensitive data)
  • Incident response playbooks, tested annually through tabletop exercises or simulations
  • Incident records: detection time, classification, containment actions, and post-incident review outcomes
  • Third-party penetration test reports and evidence of remediation of critical findings

Supply Chain and Third-Party Risk

SAMA increasingly scrutinizes vendor and outsourcing arrangements. Gather and maintain:

  • Vendor risk assessments before onboarding, covering security certifications (ISO 27001, SOC 2) and data handling practices
  • Service level agreements (SLAs) with explicit security and incident notification clauses
  • Annual vendor audit reports or attestations of compliance with SAMA and PDPL standards
  • Contractual right to audit and inspect vendor environments

Practical Steps for Evidence Collection

Automate logging and retention: Deploy centralized log management to capture security events from all critical systems. Ensure retention policies comply with PDPL and SAMA guidance (typically 2–3 years for audit trails).

Establish an evidence repository: Create a secure, indexed repository of policies, assessment reports, training records, and audit findings. Use role-based access to protect sensitive materials.

Schedule regular internal audits: Conduct semi-annual reviews of control effectiveness against the SAMA framework. Document findings and remediation plans with target dates and ownership.

Align with NCA ECC: The National Cybersecurity Authority's Essential Cyber Controls (ECC) complement SAMA's framework. Ensure your evidence base addresses both, avoiding duplication where possible.

Document training and awareness: Maintain records of mandatory cybersecurity training completion, phishing simulations, and incident reporting drills. SAMA expects a security-conscious culture, not just technical controls.

Conclusion

SAMA's framework is not a checkbox exercise. Regulators expect organizations to demonstrate a mature, evidence-based cyber risk management program. By systematically gathering and organizing evidence across governance, asset management, threat detection, and supply chain oversight, security leaders position their organizations for successful assessments and, more importantly, for resilience against evolving threats in the Saudi financial ecosystem.