Understanding SAMA's Cyber Security Framework Mandate

The Saudi Arabian Monetary Authority (SAMA) Cyber Security Framework represents the regulatory foundation for all financial institutions operating in the Kingdom. Unlike advisory guidance, SAMA's expectations carry the force of supervisory authority and are embedded in binding circulars and regulatory notices. Financial institutions must treat the Framework not as a checklist but as a governance and operational discipline that must be evidenced continuously.

The Framework aligns with international standards—including NIST Cybersecurity Framework 2.0, ISO/IEC 27001:2022, and ISO/IEC 42001 for AI governance—while reflecting Saudi Arabia's strategic priorities under Vision 2030 and the National Cybersecurity Strategy. Compliance is not optional; it is a condition of operating a financial license.

Core SAMA Expectations and Evidence Requirements

1. Governance and Board Accountability

SAMA requires that the Board of Directors and senior management establish cyber risk as a strategic business risk, not merely a technical issue. Evidence must include:

  • Board-approved cyber security policies and risk appetite statements, reviewed and updated at least annually
  • Minutes from board-level cyber risk discussions, demonstrating active oversight and decision-making
  • Documented assignment of cyber risk accountability to a named executive (typically Chief Information Security Officer or Chief Risk Officer)
  • Board-approved incident response and business continuity plans tested at least annually

Institutions should maintain a cyber risk register visible to the board, tracking threats, controls, residual risk, and remediation timelines. This register becomes the primary evidence of governance maturity.

2. Risk Assessment and Management

SAMA expects institutions to conduct formal, documented cyber risk assessments covering all critical systems, data, and third-party dependencies. Evidence includes:

  • Annual risk assessments aligned with SAMA's maturity model, covering confidentiality, integrity, and availability
  • Asset inventory and criticality classification, maintained in a central register
  • Threat and vulnerability assessments, with remediation plans and timelines
  • Third-party risk assessments for all vendors handling sensitive financial data
  • Risk treatment decisions documented and approved by management

Assessments must be conducted by qualified, independent personnel and reviewed by an audit function. Self-assessment alone is insufficient.

3. Technical and Operational Controls

SAMA's Framework specifies control families aligned with NIST and ISO standards. Institutions must evidence:

  • Identity and access management: Multi-factor authentication for privileged accounts, role-based access control, and periodic access reviews
  • Data protection: Encryption of sensitive data at rest and in transit, data classification policies, and secure disposal procedures
  • Network security: Firewalls, intrusion detection/prevention, network segmentation, and secure configuration baselines
  • Security monitoring: 24/7 Security Operations Center (SOC) capability or managed service equivalent, with centralized logging and alerting
  • Incident response: Documented procedures, tabletop exercises, and post-incident reviews

Evidence takes the form of configuration audits, penetration test reports, security assessments, and continuous monitoring dashboards reviewed by management.

4. Compliance with the Saudi Personal Data Protection Law (PDPL)

SAMA expects financial institutions to align cyber controls with the PDPL and its implementing regulations. Evidence includes:

  • Data privacy impact assessments for new systems and services
  • Documented consent and data subject rights processes
  • Breach notification procedures and incident logs
  • Data processing agreements with third parties

5. Capacity Building and Awareness

SAMA requires ongoing staff training and security awareness. Evidence must demonstrate:

  • Annual mandatory cyber security training for all staff, with completion records
  • Role-specific training for IT, security, and risk personnel
  • Phishing simulations and user awareness metrics
  • Training plans aligned with emerging threats and regulatory changes

Demonstrating Compliance: A Practical Roadmap

Documentation: Maintain a centralized compliance register mapping SAMA requirements to implemented controls, evidence location, and responsible parties. Update quarterly.

Independent Validation: Engage internal audit and external assessors to validate control effectiveness. SAMA expects evidence of independent review.

Continuous Monitoring: Implement automated monitoring and reporting dashboards. SAMA expects near-real-time visibility into security posture, not annual snapshots.

Regulatory Engagement: Maintain transparent communication with SAMA through regular reporting and prompt notification of material incidents or control failures.

Financial institutions that treat SAMA's Framework as a maturity journey—not a compliance burden—position themselves to meet regulatory expectations while building resilient, defensible security operations aligned with international best practice.