Understanding SAMA's Cyber Security Framework Expectations

The Saudi Central Bank (SAMA) Cyber Security Framework establishes a comprehensive set of mandatory controls designed to protect Saudi Arabia's financial sector from evolving threats. Unlike prescriptive checklists, the framework operates on a principles-based model that requires institutions to demonstrate how their controls map to SAMA's defined objectives across governance, risk management, technical defences, and incident response.

Financial institutions regulated by SAMA—including banks, insurance companies, and fintech entities—must now treat compliance as an ongoing evidence-gathering exercise rather than a one-time audit response. This shift reflects international best practice aligned with NIST CSF 2.0 and ISO/IEC 27001:2022, frameworks that SAMA references in its guidance.

Core Control Domains and Evidence Requirements

Governance and Risk Management

SAMA expects documented board-level cyber risk oversight, including a defined cybersecurity strategy approved by senior management. Evidence should include:

  • Board minutes demonstrating cyber risk discussion at least quarterly
  • A formal cybersecurity policy framework aligned with business objectives
  • Risk appetite statements that quantify acceptable cyber risk tolerance
  • Documented roles and responsibilities for the Chief Information Security Officer (CISO) or equivalent

Many institutions fail this domain not through lack of effort, but through poor documentation. A CISO's verbal briefing to the board carries no weight; SAMA auditors require written evidence of governance decisions and their rationale.

Asset and Access Management

SAMA mandates an authoritative inventory of critical systems and data assets, coupled with role-based access controls (RBAC). Evidence must demonstrate:

  • A maintained asset register with classification levels (critical, high, medium, low)
  • Access control matrices showing who has what permissions and why
  • Periodic access reviews with documented approval and removal of excess privileges
  • Multi-factor authentication (MFA) for all administrative and remote access

The framework expects this evidence to be current—not a snapshot from last year's audit. Continuous monitoring tools that feed into a central security dashboard provide stronger evidence than manual quarterly reviews.

Threat and Vulnerability Management

SAMA requires active identification and remediation of vulnerabilities. Evidence includes:

  • Documented vulnerability scanning and penetration testing schedules
  • Remediation tracking with agreed timelines based on severity
  • Threat intelligence integration into security operations
  • Patch management policies with defined SLAs for critical and high-risk patches

Institutions should maintain a vulnerability management dashboard accessible to the board, showing trends and remediation velocity over time.

Incident Response and Business Continuity

SAMA expects tested incident response plans and business continuity arrangements. Required evidence:

  • A documented incident response plan with defined roles and escalation paths
  • Evidence of annual tabletop exercises or simulations involving key stakeholders
  • Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical systems
  • Documented incidents with root cause analysis and remediation tracking
  • Third-party incident response retainers or pre-arranged support agreements

SAMA also mandates prompt notification of cyber incidents to the regulator. Institutions must demonstrate they have incident logging and escalation procedures that comply with SAMA's notification requirements.

Building and Maintaining an Evidence Portfolio

Compliance with SAMA's framework requires a structured approach to evidence management. Security leaders should:

  • Map controls to objectives: Create a matrix linking each SAMA control objective to your policies, procedures, and technical controls.
  • Automate evidence collection: Use security orchestration, automation, and response (SOAR) platforms and security information and event management (SIEM) systems to generate audit trails and compliance reports.
  • Maintain version control: Track policy updates, training records, and test results with clear dates and approvals.
  • Integrate with the Saudi PDPL: Align cyber controls with data protection obligations under Saudi Arabia's Personal Data Protection Law, which mandates security measures for personal data handling.
  • Prepare for NCA oversight: The National Cybersecurity Authority (NCA) coordinates with SAMA on critical infrastructure protection; ensure your evidence also addresses NCA guidelines for essential services.

Key Takeaway for Security Leaders

SAMA's framework is not a static compliance target—it is a foundation for building resilience. Institutions that treat evidence gathering as an integral part of their security operations, rather than an audit preparation task, will find themselves better positioned to detect threats, respond to incidents, and demonstrate value to the board. The framework's principles-based approach rewards thoughtful, documented security practices over checkbox compliance.