The SAMA Cyber Security Framework: Regulatory Mandate and Scope

The Saudi Arabian Monetary Authority (SAMA) Cyber Security Framework establishes binding security and resilience requirements for all financial institutions operating under SAMA's supervision. Unlike advisory guidance, the framework carries enforcement power: non-compliance can result in regulatory penalties, operational restrictions, and reputational damage. Financial leaders must treat framework obligations as mandatory, not aspirational.

The framework aligns with international standards—including ISO/IEC 27001:2022 and NIST CSF 2.0—while embedding Saudi regulatory priorities and the National Cybersecurity Authority (NCA) Cybersecurity Governance Framework. It also reinforces obligations under the Saudi Personal Data Protection Law (PDPL) and its implementing regulations, which hold organizations accountable for data breach prevention and incident reporting.

Core Domains and Evidence Requirements

Governance and Risk Management

SAMA requires documented governance structures that assign cybersecurity accountability to the board and executive leadership. Evidence must include:

  • Board-approved cybersecurity strategy and annual risk assessment
  • Defined roles and responsibilities (Chief Information Security Officer or equivalent)
  • Cyber risk register aligned to business objectives and regulatory obligations
  • Board-level reporting on risk status, incidents, and remediation progress at least quarterly

Many institutions fail this domain by treating cybersecurity as an IT function rather than a business risk. SAMA auditors expect to see evidence that non-technical executives understand and own cyber risk.

Asset and Access Management

Organizations must maintain an authoritative inventory of systems, data, and network assets; enforce least-privilege access; and implement multi-factor authentication for all remote and privileged access. Auditable evidence includes:

  • Current asset inventory (hardware, software, cloud services) with classification by criticality
  • Access control matrix and periodic access reviews (minimum annually, ideally quarterly)
  • MFA deployment logs and exception documentation
  • Privileged account management (PAM) system logs showing session recording and approval workflows

SAMA inspectors routinely identify orphaned accounts, excessive standing privileges, and weak authentication as root causes of breaches. Documented, repeatable access reviews are non-negotiable.

Threat Detection and Incident Response

SAMA mandates 24/7 security monitoring, a formal incident response plan, and evidence of regular testing. Required documentation:

  • Security Operations Center (SOC) or managed service provider (MSP) monitoring agreement with defined response time SLAs
  • Incident response plan (current version, board-approved, tested annually)
  • Tabletop exercise or simulation results demonstrating team readiness
  • Incident logs with root cause analysis and remediation tracking for the past 12–24 months
  • Breach notification procedures aligned to PDPL timelines (72-hour regulatory reporting requirement)

Passive monitoring is insufficient. SAMA expects active threat hunting, vulnerability scanning, and penetration testing results.

Business Continuity and Resilience

Organizations must demonstrate the ability to recover critical systems within defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO). Evidence includes:

  • Business continuity and disaster recovery plans (tested annually, results documented)
  • Backup and restoration logs proving regular, verified backups
  • Alternate processing site readiness or cloud failover configuration
  • Third-party resilience assessments or audit reports

Supplier and Third-Party Risk

SAMA holds organizations accountable for the security practices of vendors, outsourcing partners, and cloud providers. Auditable controls include:

  • Vendor risk assessment checklist and scoring methodology
  • Contracts with explicit security requirements and audit rights
  • Annual or biennial vendor security assessments (questionnaires, on-site audits, or certifications)
  • Incident notification clauses and breach escalation procedures

Practical Compliance Roadmap

Assess the gap: Conduct a self-assessment against the SAMA framework domains. Engage external auditors familiar with SAMA expectations to identify blind spots.

Prioritize remediation: Address governance and risk management first—these are foundational. Then strengthen detection and response capabilities, followed by resilience and third-party controls.

Document everything: SAMA auditors expect contemporaneous, auditable evidence. Retroactive documentation is a red flag. Implement a compliance management system that captures policies, assessments, training records, and incident logs in a centralized, searchable repository.

Embed compliance into operations: Cybersecurity compliance is not a one-time project. Assign accountability, establish metrics, and report progress to the board quarterly. Schedule annual framework reviews to stay current with SAMA guidance and evolving threats.

Conclusion

SAMA's Cyber Security Framework is not negotiable for financial institutions in Saudi Arabia. Demonstrating compliance requires documented governance, continuous monitoring, tested resilience plans, and accountability across the organization. Leaders who treat the framework as a checklist rather than a strategic imperative risk regulatory action and operational failure. The time to evidence compliance is now.