The SAMA Cyber Security Framework: Core Pillars and Expectations

The Saudi Arabian Monetary Authority (SAMA) Cyber Security Framework establishes mandatory requirements for all licensed financial institutions operating in the Kingdom. Unlike advisory guidance, the framework carries regulatory force and forms part of SAMA's supervisory examination programme. Financial leaders must understand that compliance is not optional—it is a condition of operating a regulated entity.

The framework rests on five core pillars: governance and risk management, security operations, incident management and business continuity, cybersecurity culture and awareness, and third-party and supply chain risk management. Each pillar contains specific control objectives that institutions must evidence through documentation, testing, and audit trails.

Governance and Risk Management: The Foundation

SAMA expects a board-level cybersecurity committee or equivalent oversight body with defined terms of reference. This is not a checkbox exercise. Security leaders must demonstrate that:

  • The board receives regular cybersecurity risk reports (at minimum quarterly) that connect technical findings to business impact and regulatory exposure.
  • A documented cybersecurity strategy exists, approved by senior management, with clear objectives aligned to the institution's risk appetite.
  • Risk assessments are conducted annually at minimum, covering all critical systems, data flows, and third-party dependencies. These must be documented and traceable.
  • Policies and procedures covering access control, change management, vulnerability management, and incident response are formally approved and kept current.

Evidence means written policies, board minutes showing discussion and approval, and a versioning record showing updates. SAMA examiners will ask: when was this last reviewed? Who approved the change? What risk triggered the update?

Security Operations: Continuous Monitoring and Detection

SAMA requires institutions to operate a Security Operations Center (SOC) or equivalent monitoring capability proportionate to the institution's size and risk profile. This means:

  • 24/7 monitoring of critical systems and networks, with defined escalation procedures and response times.
  • Log aggregation and analysis covering authentication, privileged access, network traffic, and application events.
  • Vulnerability scanning and patch management processes with documented remediation timelines.
  • Penetration testing and security assessments conducted at least annually by qualified external parties, with findings tracked to closure.

Evidence includes SOC dashboards, alert logs, patch deployment records, and third-party assessment reports. SAMA will verify that findings are not merely reported but acted upon with documented remediation plans and completion dates.

Incident Management and Business Continuity

The framework mandates a documented incident response plan tested at least annually through tabletop exercises or simulations. SAMA expects:

  • Clear incident classification criteria and escalation thresholds, including mandatory reporting to SAMA for significant incidents.
  • Defined roles and responsibilities for the incident response team, with contact details and backup designations.
  • Post-incident reviews that capture root cause analysis, lessons learned, and preventive measures implemented.
  • Business continuity and disaster recovery plans covering all critical services, with recovery time objectives (RTO) and recovery point objectives (RPO) documented and tested.

Evidence requires incident logs, response timelines, communications records, and post-incident reports. SAMA examiners will examine actual incidents from the past year to verify the institution followed its documented procedures.

Alignment with International Standards and the Saudi PDPL

The SAMA framework aligns closely with ISO/IEC 27001:2022 and the NIST Cybersecurity Framework 2.0. Many institutions find it efficient to adopt a unified control framework that satisfies both SAMA requirements and ISO/IEC 27001 certification. This approach also supports compliance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations, which impose data protection and breach notification obligations on all entities handling personal data.

The National Cybersecurity Authority (NCA) Cyber Security Framework for critical infrastructure also complements SAMA's requirements. Financial institutions classified as critical infrastructure must ensure their SAMA compliance programme extends to NCA expectations for resilience and national security.

Practical Steps for Immediate Compliance

Security leaders should conduct a gap assessment against the SAMA framework now. Document the current state of each control, identify gaps, and prioritize remediation based on risk and regulatory impact. Ensure policies are written, approved, and communicated. Establish metrics and KPIs that demonstrate control effectiveness to the board. Finally, prepare for SAMA examinations by maintaining an organized evidence repository—policies, test results, incident records, and third-party reports—readily accessible to auditors.

Compliance with SAMA is not a one-time effort but an ongoing programme of governance, monitoring, and continuous improvement. The framework's strength lies in its clarity: financial leaders now have an explicit regulatory roadmap for building and evidencing a resilient cybersecurity posture.