Understanding SAMA's Cyber Security Framework Mandate

The Saudi Arabian Monetary Authority (SAMA) Cyber Security Framework establishes mandatory expectations for all financial institutions operating in the Kingdom. Unlike prescriptive checklists, the framework operates on a maturity continuum, requiring organizations to demonstrate progressive capability across governance, risk management, and technical resilience. This principle-based approach aligns with international standards—including NIST Cybersecurity Framework 2.0 and ISO/IEC 27001:2022—while embedding Saudi regulatory context and the requirements of the Saudi Personal Data Protection Law (PDPL).

The framework's core domains span organizational leadership, asset and risk management, threat detection and response, supply chain security, and incident recovery. Each domain maps to measurable maturity levels, typically ranging from ad hoc or reactive (Level 1) through optimized and predictive (Level 4 or 5). SAMA expects institutions to achieve baseline maturity appropriate to their risk profile and asset criticality, with evidence that controls are not merely documented but operationally effective.

Key Compliance Pillars and Evidence Requirements

Governance and Board Accountability

SAMA requires a documented cyber governance structure with clear roles, accountability, and board-level oversight. Evidence must include:

  • Board or audit committee minutes demonstrating cyber risk review at least quarterly
  • Cyber security strategy approved by senior management and aligned with business objectives
  • Defined roles for Chief Information Security Officer (CISO) or equivalent, with direct reporting lines and adequate budget allocation
  • Policies covering incident response, business continuity, and third-party risk management

Risk Assessment and Management

Organizations must conduct comprehensive, documented risk assessments annually at minimum, with evidence of:

  • Inventory of critical assets, systems, and data flows, classified by sensitivity and regulatory relevance (especially data subject to PDPL)
  • Threat modeling and vulnerability assessments performed by qualified personnel or external specialists
  • Risk registers showing identified threats, likelihood, impact, and mitigation strategies
  • Remediation tracking and evidence of control effectiveness testing

Technical Controls and Detection Capabilities

SAMA expects demonstrable technical resilience. Security leaders should evidence:

  • Network segmentation and access controls aligned with the principle of least privilege
  • Encryption of sensitive data in transit and at rest, with key management procedures
  • Security monitoring through a Security Operations Center (SOC) or equivalent, with defined escalation and response procedures
  • Endpoint protection, patch management, and vulnerability remediation timelines
  • Logging and audit trails retained for the period specified by SAMA and PDPL regulations

Incident Response and Continuity

Institutions must demonstrate operational readiness:

  • Tested incident response plans with defined roles, communication protocols, and escalation paths
  • Regular tabletop exercises or simulations, with documented outcomes and lessons learned
  • Business continuity and disaster recovery plans with documented Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)
  • Evidence of recovery testing at least annually

Third-Party and Supply Chain Risk

SAMA recognizes that cyber risk extends beyond organizational boundaries. Evidence should include:

  • Vendor assessment frameworks evaluating cyber maturity and compliance posture
  • Contractual clauses requiring vendors to meet defined security standards
  • Periodic audits or assessments of critical third parties
  • Incident notification and escalation procedures for vendor-related breaches

Building and Maintaining an Evidence Repository

Compliance is not a one-time submission; SAMA conducts ongoing supervision. Security leaders should maintain organized evidence repositories—physical or digital—containing:

  • Policy documents with version control and approval signatures
  • Assessment reports and audit findings with remediation evidence
  • Training records demonstrating staff awareness and competency
  • Incident logs and post-incident reviews
  • Configuration baselines and change management records
  • Compliance attestations and third-party audit reports (e.g., SOC 2 Type II)

Documentation should be current, accessible to auditors, and demonstrably linked to operational reality. A gap between policy and practice is a common audit finding and signals immature controls.

Alignment with Broader Regulatory Expectations

The SAMA framework does not exist in isolation. Institutions must also align with the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC) and the Saudi PDPL's data protection and breach notification requirements. Demonstrating compliance across these frameworks—rather than treating them as separate exercises—strengthens overall resilience and reduces audit friction.

By embedding evidence collection into operational workflows, establishing clear ownership, and regularly reviewing maturity against framework benchmarks, security leaders can transform compliance from a burden into a driver of genuine cyber resilience.