Understanding the Current SAMA Cyber Security Framework

The Saudi Central Bank (SAMA) Cyber Security Framework represents the regulatory baseline for all financial institutions operating in the Kingdom. Unlike prescriptive checklists, the SAMA CSF adopts a risk-based, outcomes-focused approach aligned with international standards including NIST CSF 2.0 and ISO/IEC 27001:2022. This shift means compliance is no longer about ticking boxes—it is about demonstrating mature, proportionate control over cyber risk.

Financial institutions must now evidence their security posture across five core domains: governance and risk management, asset and data protection, access and identity management, detection and response, and resilience and recovery. Each domain carries specific expectations that SAMA examiners assess during on-site reviews and through submission of control documentation.

Key Compliance Pillars and Evidence Requirements

1. Board-Level Governance and Accountability

SAMA expects the board of directors or its designated committee to own cyber risk as a business risk, not a technology issue. Evidence includes:

  • Board meeting minutes documenting cyber risk review at least quarterly
  • A documented cyber risk appetite statement aligned with the institution's risk tolerance
  • Appointment of a Chief Information Security Officer (CISO) with direct board access
  • Board-approved cyber security strategy and annual budget allocation

2. Risk Assessment and Management

Institutions must conduct annual enterprise-wide cyber risk assessments that identify threats, vulnerabilities, and business impact. SAMA auditors expect to see:

  • Documented risk assessment methodology (e.g., NIST RMF or ISO 27005 principles)
  • Risk register with likelihood and impact ratings for critical assets
  • Mitigation plans for high-risk findings with assigned owners and timelines
  • Evidence of reassessment following material changes to systems or threat landscape

3. Technical and Operational Controls

The framework mandates specific control families:

  • Access Control: Multi-factor authentication for all privileged accounts; role-based access control (RBAC) for sensitive data
  • Data Protection: Encryption of data in transit and at rest; data classification and handling procedures compliant with the Saudi Personal Data Protection Law (PDPL)
  • Monitoring and Detection: 24/7 Security Operations Center (SOC) capability or managed service provider with documented SLAs
  • Incident Response: Tested incident response plan; mandatory reporting to SAMA within 24 hours of material incidents

4. Third-Party and Vendor Management

Since supply chain breaches pose systemic risk, SAMA requires:

  • Vendor risk assessment before onboarding critical service providers
  • Contractual cyber security requirements aligned with the SAMA CSF
  • Annual audit or attestation (e.g., SOC 2 Type II) from third parties handling sensitive data
  • Incident notification clauses with defined timelines

5. Testing, Assurance, and Continuous Improvement

SAMA expects evidence of control effectiveness through:

  • Annual penetration testing by independent external firms
  • Vulnerability scanning and remediation tracking
  • Tabletop and full-scale incident response exercises at least twice yearly
  • Internal audit program with cyber security scope; findings tracked to closure
  • External assurance (ISO 27001:2022 certification or equivalent) for critical business functions

Documentation and Audit Trail

SAMA examiners expect all controls to be documented, dated, and traceable. Institutions should maintain a central repository containing:

  • Policies and procedures with approval dates and version history
  • Control testing results and remediation evidence
  • Board and committee meeting records
  • Incident logs and post-incident reviews
  • Training completion records for all staff with system access

Alignment with Broader GCC and International Standards

The SAMA CSF is increasingly harmonized with the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC) and international frameworks. Institutions that achieve ISO/IEC 27001:2022 certification or comply with NIST CSF 2.0 principles typically satisfy SAMA expectations, provided they document how controls map to SAMA's five domains.

Practical Next Steps

Security leaders should conduct a gap assessment against the current SAMA CSF, prioritize evidence collection, and establish a compliance calendar aligned with SAMA's examination cycle. Engaging external auditors early and maintaining a living control inventory reduces friction during regulatory reviews and strengthens the institution's cyber resilience posture.