Understanding SAMA's Current Expectations

The Saudi Central Bank (SAMA) Cyber Security Framework now requires financial institutions to operate under a structured, risk-based security posture aligned with international standards such as NIST CSF 2.0 and ISO/IEC 27001:2022. Unlike earlier guidance that emphasized self-regulation, the current framework demands documented, verifiable compliance across five core domains: governance and risk management, security operations, resilience and recovery, third-party risk management, and regulatory reporting.

SAMA expects institutions to treat cybersecurity as a board-level governance issue, not a technical checkbox. This means the Chief Information Security Officer (CISO) or equivalent must report directly to senior leadership with unrestricted access to resources and decision-making authority. Cyber risk must be integrated into enterprise risk management, capital adequacy assessments, and strategic planning.

Evidence Requirements: Moving Beyond Self-Attestation

SAMA's supervisory approach now emphasizes third-party validation and continuous monitoring. Institutions cannot rely on internal declarations; regulators expect:

  • Annual independent security assessments conducted by qualified external auditors or penetration testing firms, with findings formally documented and remediation tracked.
  • Audit trails and logs retained for at least one year (extended to three years for critical events), demonstrating who accessed what, when, and why.
  • Incident response drills executed at least twice yearly, with tabletop exercises, full simulations, and documented outcomes shared with the board.
  • Vulnerability management programs showing patch deployment timelines, compensating controls for unpatched systems, and evidence of scanning frequency aligned to asset criticality.
  • Access control matrices proving role-based access control (RBAC) is enforced, segregation of duties is maintained, and privileged access is monitored in real time.

Alignment with NCA ECC and PDPL

SAMA's framework does not operate in isolation. The National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC) provide the baseline for all critical infrastructure operators, including financial institutions. Institutions must evidence compliance with both SAMA and NCA standards simultaneously.

The Saudi Personal Data Protection Law (PDPL) and its implementing regulations add a parallel requirement: institutions handling customer data must demonstrate data classification, encryption in transit and at rest, and breach notification procedures. SAMA now expects institutions to produce data protection impact assessments for new systems and third-party integrations, with evidence of privacy-by-design principles.

Practical Compliance Roadmap

1. Governance and Policy: Publish a formal Cyber Security Policy approved by the board, with annual reviews documented. Ensure the policy explicitly references SAMA requirements, NCA ECC controls, and PDPL obligations.

2. Risk Assessment and Management: Conduct annual enterprise-wide cyber risk assessments using a recognized framework (NIST, ISO 31000). Document risk appetite, tolerance levels, and mitigation strategies. Maintain a risk register updated quarterly and reviewed by the audit committee.

3. Technical Controls: Implement and evidence multi-factor authentication (MFA) for all remote and privileged access, network segmentation, and endpoint detection and response (EDR) tools. Maintain configuration baselines and change logs.

4. Incident Response: Establish a documented incident response plan with clear escalation paths. Conduct drills with external participants (regulators, law enforcement liaison contacts) and retain after-action reports.

5. Third-Party Management: Require security assessments from all vendors handling customer data or critical systems. Maintain vendor risk scorecards and evidence of contractual security clauses.

6. Regulatory Reporting: Prepare quarterly cyber risk dashboards for the board and senior management. Submit mandatory incident reports to SAMA within the prescribed timeframe (typically 24 hours for critical incidents).

Key Takeaway

SAMA's current framework is outcome-focused and evidence-driven. Compliance is not a one-time audit; it is a continuous cycle of assessment, remediation, and validation. Financial institutions that embed cybersecurity into governance, maintain rigorous documentation, and engage third-party validators will satisfy SAMA's expectations and reduce regulatory risk.