Understanding SAMA's Cyber Security Framework Mandate

The Saudi Central Bank (SAMA) Cyber Security Framework establishes baseline and advanced security controls for all financial institutions operating in the Kingdom. Unlike prescriptive checklists, the framework emphasizes risk-based governance, proportionate controls, and documented evidence of compliance. Financial institutions must demonstrate not only that controls exist, but that they are effective, monitored, and continuously improved.

The framework aligns with international standards—particularly ISO/IEC 27001:2022 and NIST Cybersecurity Framework 2.0—while addressing Saudi Arabia's regulatory environment and the Central Bank's supervisory expectations. Compliance is not a one-time audit; it is an ongoing governance obligation.

Core SAMA Expectations and Evidence Requirements

1. Risk Management and Governance

SAMA expects financial institutions to maintain a documented information security risk management program. Evidence includes:

  • Risk register: Inventory of identified assets, threats, and vulnerabilities with current risk ratings and mitigation status.
  • Board and audit committee minutes: Records showing senior leadership oversight of cybersecurity strategy, budget allocation, and incident escalation.
  • Security policy framework: Approved policies covering access control, data classification, incident response, and third-party risk management, with documented review cycles.
  • Risk assessment reports: Periodic (at least annual) formal assessments with signed approval from business and technology leadership.

2. Technical and Operational Controls

SAMA mandates controls across network security, data protection, and access management. Evidence includes:

  • System inventory and configuration baselines: Documented records of authorized hardware, software versions, and security settings, with change logs.
  • Vulnerability management logs: Scans, assessments, remediation tickets, and closure evidence showing timely patching of critical and high-risk issues.
  • Access control matrices: Role-based access control (RBAC) documentation, user provisioning/deprovisioning records, and periodic access reviews with sign-off.
  • Encryption and data protection: Proof of encryption standards (AES-256 or equivalent) for data in transit and at rest, with key management procedures.
  • Logging and monitoring: Security Information and Event Management (SIEM) configuration records, alert tuning documentation, and retention policies aligned with SAMA's requirements.

3. Incident Response and Business Continuity

SAMA requires a tested incident response plan and evidence of preparedness:

  • Incident response plan: Approved, version-controlled document with defined roles, escalation paths, and communication templates.
  • Tabletop and simulation exercises: Annual or more frequent drills with documented scenarios, participant lists, findings, and corrective actions.
  • Incident logs: Records of all security incidents (or near-misses), severity classifications, response timelines, root cause analysis, and remediation steps.
  • Business continuity and disaster recovery (BC/DR) plans: Documented recovery time objectives (RTOs) and recovery point objectives (RPOs), with proof of testing and updates.

4. Third-Party and Supply Chain Risk

SAMA expects oversight of vendors and service providers. Evidence includes:

  • Third-party risk assessments: Documented evaluation of critical vendors' security posture, certifications, and audit results.
  • Service level agreements (SLAs): Contracts with explicit security, availability, and incident notification clauses.
  • Audit and monitoring records: Periodic vendor security reviews, audit reports, and evidence of remediation of identified gaps.

Building an Evidence Management Program

To meet SAMA expectations, establish a governance, risk, and compliance (GRC) platform or structured repository that centralizes:

  • Policy versions and approval workflows
  • Risk assessments and remediation tracking
  • Control testing and audit evidence
  • Incident and near-miss records
  • Training and awareness completion logs
  • Board and committee communications

Assign clear ownership for evidence collection and retention. Align evidence retention periods with SAMA's guidance (typically three to five years for critical records) and regulatory requirements under the Saudi Personal Data Protection Law (PDPL).

Staying Current with SAMA Expectations

SAMA periodically updates its guidance and expectations. Financial institutions should maintain active engagement with the Central Bank, participate in industry forums, and conduct annual compliance gap assessments against the latest framework version. Integration with the National Cybersecurity Authority (NCA) Emergency and Crisis Center (ECC) incident reporting requirements is also essential.

Compliance with SAMA's Cyber Security Framework is a competitive advantage and a regulatory necessity. Security leaders who invest in documented, proportionate controls and transparent governance will demonstrate resilience to regulators, customers, and stakeholders.