Understanding the SAMA Cyber Security Framework

The Saudi Central Bank (SAMA) Cyber Security Framework establishes mandatory expectations for all financial institutions operating under its supervision. Unlike a checklist of tools, the framework demands a structured, risk-driven approach to cybersecurity governance that aligns with international standards—particularly NIST CSF 2.0 principles—while meeting Saudi Arabia's regulatory environment, including the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC) and the Saudi Personal Data Protection Law (PDPL).

The framework operates across five core pillars: governance and risk management, asset management, access control, data protection, and incident response and resilience. Each pillar requires not just policies, but demonstrable, repeatable processes with documented outcomes.

Governance and Risk Management: The Foundation

SAMA expects financial institutions to establish a formal cybersecurity governance structure with clear roles, accountability, and board-level oversight. Evidence of compliance includes:

  • Cybersecurity strategy and roadmap: A documented, board-approved multi-year plan tied to business objectives and regulatory requirements.
  • Risk assessment reports: Annual or bi-annual formal risk assessments identifying threats, vulnerabilities, and residual risk, with sign-off from senior management.
  • Risk register and mitigation plans: A live register tracking identified risks, assigned owners, mitigation actions, and target completion dates.
  • Board reporting cadence: Documented evidence that cybersecurity metrics, incidents, and strategic initiatives are reported to the board at defined intervals.
  • Third-party risk management: Contracts, assessments, and audit logs showing oversight of vendors and service providers, aligned with PDPL data processor requirements.

Technical Controls and NCA ECC Alignment

The NCA ECC provides a baseline of technical and operational controls. SAMA expects institutions to map their architecture and processes to these controls and maintain evidence of implementation:

  • Configuration management: Baseline configurations, change logs, and compliance scanning reports for servers, networks, and endpoints.
  • Access control documentation: Role-based access control (RBAC) matrices, privileged access management (PAM) logs, and multi-factor authentication (MFA) deployment records.
  • Data classification and handling: Data inventory, classification labels, encryption deployment records, and data retention policies aligned with the PDPL.
  • Security monitoring: SOC dashboards, alert tuning documentation, and logs demonstrating continuous monitoring of critical systems.
  • Patch and vulnerability management: Patch deployment schedules, vulnerability scan results, and remediation timelines for identified weaknesses.

Incident Response and Resilience

SAMA mandates that institutions maintain operational resilience and respond effectively to cyber incidents. Key evidence artifacts include:

  • Incident response plan: A documented playbook with defined roles, escalation procedures, and communication protocols, updated annually and tested through tabletop exercises.
  • Business continuity and disaster recovery (BC/DR) plans: Tested recovery procedures, recovery time objectives (RTOs), and recovery point objectives (RPOs) for critical systems.
  • Incident logs and post-mortems: Records of detected and reported incidents, root cause analysis, and corrective actions implemented.
  • Regulatory notification procedures: Documented processes for reporting incidents to SAMA and other authorities within required timeframes, compliant with PDPL breach notification rules.

Demonstrating Compliance: Practical Steps

Security leaders should establish a compliance evidence repository—a centralized system for storing, versioning, and retrieving documentation. This repository should include:

  • Policy and procedure documents with approval dates and review schedules.
  • Assessment reports, audit findings, and remediation tracking.
  • System configuration baselines and change management records.
  • Training and awareness completion records for staff and contractors.
  • Third-party assessment reports and attestations.

Conduct annual self-assessments against the SAMA framework and NCA ECC, document findings, and maintain a corrective action plan. Engage external auditors to validate compliance and provide third-party assurance to regulators.

Looking Forward

Compliance with the SAMA Cyber Security Framework is not a one-time effort but a continuous cycle of assessment, improvement, and evidence gathering. As the threat landscape evolves and regulations tighten, institutions that embed cybersecurity governance into their operational DNA—and systematically document their efforts—will be best positioned to meet current and future regulatory expectations while protecting their customers and assets.