Understanding the Current SAMA Cyber Security Framework

The Saudi Arabian Monetary Authority (SAMA) has established a comprehensive Cyber Security Framework that applies to all financial institutions under its supervision, including banks, insurance companies, and fintech entities. This framework is not advisory; it represents mandatory regulatory expectations that must be embedded into operational and strategic governance.

The framework aligns with international standards such as ISO/IEC 27001:2022 and NIST Cybersecurity Framework 2.0, while reflecting the Kingdom's own regulatory priorities under the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC) and the Saudi Personal Data Protection Law (PDPL). Institutions must treat SAMA's expectations as baseline requirements, not aspirational goals.

Core Pillars of SAMA Expectations

Governance and Accountability

SAMA expects financial institutions to establish a clear governance structure with defined roles and responsibilities for cybersecurity. This includes:

  • A board-level cybersecurity committee or equivalent oversight body with documented charter and meeting records
  • A Chief Information Security Officer (CISO) or equivalent with direct reporting line to senior management and board visibility
  • Documented cybersecurity policies covering all critical business functions
  • Evidence of board-level risk reporting at least quarterly, with documented decisions and actions

Security leaders must maintain board minutes, CISO appointment letters, and policy approval records. These are primary evidence artifacts during regulatory examinations.

Risk Assessment and Management

SAMA mandates regular, documented risk assessments aligned with the institution's risk appetite. Evidence should include:

  • Annual enterprise-wide cybersecurity risk assessments covering all systems, data, and third parties
  • Risk registers with documented ratings, mitigation plans, and owner accountability
  • Vulnerability assessments and penetration testing performed by qualified external parties at least annually
  • Business continuity and disaster recovery plans tested and validated annually with documented results

Assessments must be dated, signed by authorized personnel, and linked to remediation timelines. SAMA reviewers will examine whether identified risks have corresponding mitigation actions with realistic completion dates.

Technical Controls and Monitoring

The NCA ECC and SAMA expectations require:

  • Multi-factor authentication for all privileged access and remote connections
  • Encryption of data in transit and at rest using current cryptographic standards
  • Continuous security monitoring through a Security Operations Center (SOC) or managed service provider
  • Intrusion detection and prevention systems with documented alert protocols
  • Endpoint detection and response (EDR) on all critical systems

Evidence includes system configuration baselines, monitoring dashboards, alert logs, and SOC incident response records. Institutions should maintain 12 months of audit logs for regulatory review.

Incident Response and Reporting

SAMA requires a documented incident response plan with:

  • Defined incident classification levels and escalation procedures
  • Incident response team composition and contact information
  • Testing of the plan through tabletop exercises or simulations at least annually
  • Mandatory reporting to SAMA within the timeframe specified in current regulations for material security incidents

Maintain incident logs showing detection time, response actions, containment measures, and post-incident reviews. SAMA will examine whether incidents were properly classified and whether reporting obligations were met.

Third-Party and Supply Chain Risk

SAMA places significant emphasis on third-party cybersecurity risk. Evidence required includes:

  • Documented inventory of all critical third-party service providers with risk ratings
  • Cybersecurity assessment questionnaires or audit reports from critical vendors
  • Service level agreements (SLAs) with explicit cybersecurity and incident notification clauses
  • Regular monitoring of third-party compliance, including audit results and vulnerability disclosures

SAMA recognizes that outsourcing does not eliminate institutional responsibility. Maintain evidence of vendor due diligence, ongoing monitoring, and contractual remediation of identified gaps.

Practical Evidence-Gathering Strategy

To demonstrate compliance effectively, establish a centralized repository for cybersecurity evidence organized by framework pillar. Include:

  • Policy documents with approval dates and version control
  • Risk assessment reports with executive summaries and board sign-off
  • Audit reports from external assessors with management responses
  • Training and awareness records for staff and board members
  • Incident logs and post-incident reviews
  • Third-party assessment results and compliance confirmations

Ensure all evidence is dated, signed by appropriate authorities, and cross-referenced to specific SAMA expectations. SAMA examiners typically request a compliance matrix mapping institutional controls to framework requirements; prepare this proactively.

Conclusion

SAMA's Cyber Security Framework is not a checkbox exercise. It reflects the Kingdom's commitment to financial system resilience and aligns with global best practice. Security leaders who embed these expectations into governance, risk, and technical operations—and who systematically document compliance—will satisfy regulatory requirements and strengthen institutional defenses against an evolving threat landscape.