Understanding SAMA's Current Cyber Security Framework

The Saudi Arabian Monetary Authority (SAMA) Cyber Security Framework is the primary regulatory standard governing cybersecurity for financial institutions in the Kingdom. Unlike voluntary frameworks, SAMA's requirements are binding on all regulated entities—banks, insurance companies, payment processors, and fintech operators. The framework establishes baseline controls across governance, risk management, incident response, and technical security, with explicit expectations for board oversight and management accountability.

SAMA's framework aligns with international standards including ISO/IEC 27001:2022 and NIST Cybersecurity Framework 2.0, but adds Saudi-specific requirements including integration with the National Cybersecurity Authority (NCA) incident reporting protocols and compliance with the Saudi Personal Data Protection Law (PDPL). This convergence means security leaders must evidence controls at three levels: SAMA-specific requirements, alignment with recognized international standards, and integration with national incident-response and data-protection obligations.

Core Pillars and Evidence Requirements

Governance and Oversight

SAMA mandates that the board of directors and senior management establish a cybersecurity strategy with clear roles, responsibilities, and accountability. Evidence must include:

  • Board-approved cybersecurity policy and annual strategy review minutes
  • Defined cybersecurity committee charter with documented meeting records
  • Chief Information Security Officer (CISO) appointment letter and direct reporting line to board or audit committee
  • Risk appetite statement specific to cybersecurity
  • Annual cybersecurity budget allocation and board approval documentation

Security leaders should maintain a governance register showing how board decisions cascade into operational policies, with evidence of management sign-off at each level.

Risk Assessment and Management

SAMA requires annual risk assessments covering all critical assets, systems, and data flows. Evidence includes:

  • Documented risk assessment methodology aligned with ISO/IEC 27005 principles
  • Current risk register identifying threats, vulnerabilities, and residual risk ratings
  • Risk treatment plans with assigned owners and completion timelines
  • Board-level risk reporting showing trend analysis and emerging threats
  • Third-party and supply-chain risk assessments with contractual controls

The framework expects risk management to be continuous, not annual; security leaders should evidence quarterly reviews and updates to reflect changing threat landscapes and organizational changes.

Technical and Operational Controls

SAMA specifies controls across access management, data protection, incident detection, and business continuity. Key evidence items:

  • Access control matrices showing role-based permissions and segregation of duties
  • Encryption standards documentation and key management procedures
  • Security Operations Center (SOC) or equivalent monitoring logs and alert response records
  • Vulnerability management program with scan results, remediation tracking, and patch deployment records
  • Incident response plan with tabletop exercise results and post-incident reviews
  • Business continuity and disaster recovery test results with recovery time objective (RTO) and recovery point objective (RPO) verification

Incident Response and NCA Coordination

SAMA expects integration with the NCA's incident reporting framework. Evidence must demonstrate:

  • Incident classification and escalation procedures
  • NCA notification timelines (typically within 24 hours of discovery)
  • Incident investigation reports with root cause analysis
  • Communication logs with regulators and affected parties

Building an Audit-Ready Evidence Repository

Security leaders should establish a centralized compliance repository organized by SAMA requirement, with version control and sign-off trails. Use a matrix linking each SAMA control to supporting evidence: policies, procedures, system logs, audit reports, training records, and management attestations. Ensure evidence is dated, signed, and traceable to responsible individuals.

Conduct annual internal audits or third-party assessments against the SAMA framework to identify gaps before regulatory examination. Document remediation of any findings with timelines and completion evidence.

Staying Current

SAMA periodically updates guidance and expectations; subscribe to SAMA circulars and coordinate with the NCA on evolving threat intelligence and regulatory changes. Integrate PDPL compliance evidence (data inventory, consent records, breach notification logs) into your SAMA submission to demonstrate holistic governance.

The framework is not a one-time compliance exercise—it requires sustained governance, regular evidence updates, and demonstrated management commitment. Security leaders who maintain clear, organized, auditable evidence will navigate SAMA examinations confidently and reduce operational and reputational risk.