The SAMA Cyber Security Framework: Current Scope and Expectations

The Saudi Arabian Monetary Authority (SAMA) Cyber Security Framework remains the primary regulatory baseline for financial institutions operating in the Kingdom. Unlike prescriptive checklists, the framework is outcome-focused: it defines what financial organizations must achieve in cybersecurity posture, not necessarily how. This principle-based approach aligns with international standards such as ISO/IEC 27001:2022 and NIST CSF 2.0, but SAMA's expectations are mandatory for all SAMA-regulated entities.

The framework organizes cybersecurity into five core functions: Governance, Risk Management, Technical Controls, Incident Response, and Resilience. Each function contains multiple control objectives. Financial institutions must map their existing security programs to these functions and demonstrate measurable compliance through evidence—not simply through policy documents.

Governance: The Foundation of Compliance Evidence

SAMA expects board-level accountability for cybersecurity. Security leaders must evidence this through:

  • Board reporting and oversight: Documented board minutes, cybersecurity committee charters, and quarterly risk dashboards showing board engagement with cyber risk as a business risk, not merely an IT issue.
  • Defined roles and responsibilities: An organizational chart and RACI matrix showing who owns cybersecurity decisions, incident response, and risk escalation. The Chief Information Security Officer (CISO) or equivalent must have clear authority and direct access to senior leadership.
  • Cybersecurity strategy and roadmap: A multi-year strategic document aligned with business objectives, regulatory requirements (including the Saudi Data Protection Law, PDPL), and industry benchmarks. Evidence includes budget allocation, staffing plans, and technology investments.
  • Policy framework: A complete set of cybersecurity policies covering access control, data classification, third-party risk, and acceptable use. Policies must be reviewed annually and version-controlled.

Risk Management: Quantifying and Monitoring Exposure

SAMA requires financial institutions to conduct regular, documented risk assessments. Evidence includes:

  • Annual risk assessments: Formal assessments covering all critical systems, data repositories, and third-party dependencies. Assessments must identify threats, vulnerabilities, and business impact. Use a recognized methodology (ISO 31000, NIST RMF, or equivalent).
  • Risk registers: Living documents listing identified risks, their residual risk scores, mitigation actions, and ownership. Demonstrate that high-risk items are actively managed and tracked to closure.
  • Third-party risk management: Documented processes for assessing and monitoring vendors and service providers. Evidence includes vendor security questionnaires, audit reports, and contractual security clauses aligned with PDPL requirements for data processors.
  • Business continuity and disaster recovery plans: Tested plans with documented recovery time objectives (RTOs) and recovery point objectives (RPOs) for critical services. Annual testing results and lessons-learned reports are essential evidence.

Technical Controls: Demonstrating Effective Implementation

SAMA expects proportionate technical controls. Evidence includes:

  • Access control logs: Centralized logging and monitoring of user access, privileged account activity, and administrative changes. Regular access reviews with sign-off from system owners.
  • Encryption and data protection: Documented encryption standards for data in transit and at rest. Evidence of encryption key management processes and compliance with PDPL's data protection obligations.
  • Security monitoring: A functioning Security Operations Center (SOC) or equivalent, with documented alerts, escalation procedures, and response times. Metrics showing mean time to detect (MTTD) and mean time to respond (MTTR).
  • Vulnerability management: Regular vulnerability scans, penetration testing, and patch management. Evidence includes scan reports, remediation timelines, and sign-off on exceptions.

Incident Response: Readiness and Learning

SAMA mandates incident response capability. Evidence includes:

  • Incident response plan: A detailed, tested plan covering detection, containment, eradication, recovery, and post-incident review. Annual tabletop exercises and simulations are required.
  • Incident logs: Documented records of all security incidents, their severity, response actions, and outcomes. Even minor incidents must be logged to demonstrate a mature incident culture.
  • Regulatory notifications: Compliance with SAMA's incident reporting requirements, including timely notification of material breaches.

Building and Maintaining Your Evidence Portfolio

Effective compliance is not a one-time audit exercise. Security leaders should maintain a centralized compliance repository—a shared drive, governance platform, or audit management system—that organizes evidence by SAMA control objective. Update evidence quarterly, and prepare an annual compliance self-assessment. When SAMA examiners arrive, this portfolio becomes your proof of commitment to cybersecurity excellence.