Understanding the SAMA Cyber Security Framework

The Saudi Arabian Monetary Authority's Cyber Security Framework (SAMA CSF) establishes a baseline of mandatory controls and practices for financial institutions and critical infrastructure operators in the Kingdom. Unlike advisory frameworks, the SAMA CSF carries regulatory force: compliance is not optional, and evidence of implementation is required during supervisory reviews and audits.

The framework aligns with international standards—particularly NIST Cybersecurity Framework 2.0 and ISO/IEC 27001:2022—while addressing the specific risk environment and regulatory expectations of Saudi Arabia. It emphasizes accountability, measurable outcomes, and the integration of cybersecurity into business strategy and governance.

Core Pillars and Control Domains

The SAMA CSF organizes controls into five core functions: Govern, Identify, Protect, Detect, and Respond. Each function contains specific practices and outcomes that organizations must instantiate:

  • Govern: Board and executive oversight, cybersecurity strategy aligned to business objectives, roles and accountability, and integration with enterprise risk management.
  • Identify: Asset inventory, threat and vulnerability assessment, risk prioritization, and third-party and supply-chain risk management.
  • Protect: Access controls, data classification and encryption, secure development practices, and resilience planning.
  • Detect: Continuous monitoring, logging, SIEM or equivalent detection infrastructure, and threat intelligence integration.
  • Respond: Incident response planning, communication protocols, forensic capability, and post-incident learning.

Building an Evidence Portfolio

Regulators and auditors expect organizations to demonstrate control implementation through multiple forms of evidence. A mature evidence portfolio includes:

  • Policy and Procedure Documentation: Board-approved cybersecurity policy, procedures for access management, incident response, and third-party risk assessment. These must be current, aligned to the SAMA CSF, and demonstrably communicated to staff.
  • Technical Logs and Monitoring Data: Continuous records from firewalls, intrusion detection systems, endpoint detection and response (EDR) platforms, and centralized logging infrastructure. Evidence should show active detection and alerting, not passive collection.
  • Assessment and Testing Results: Annual penetration tests, vulnerability scans, control self-assessments, and third-party audit findings. Document remediation timelines and closure evidence.
  • Training and Awareness Records: Mandatory cybersecurity training completion rates, phishing simulation results, and board-level awareness updates on cyber risk.
  • Incident and Change Logs: Records of detected incidents, investigation summaries, response actions, and post-incident reviews. Change management logs showing authorization and testing of security-relevant changes.
  • Board and Audit Committee Minutes: Evidence that cybersecurity is a standing agenda item, that risk metrics are reviewed, and that resource requests are approved and tracked.

Alignment with Related Frameworks

The SAMA CSF does not exist in isolation. Organizations must also consider:

  • NCA Essential Cybersecurity Controls (ECC): The National Cybersecurity Authority's baseline controls for critical infrastructure. Ensure SAMA CSF implementation covers NCA ECC requirements.
  • Saudi Personal Data Protection Law (PDPL): Data protection and breach notification obligations. Incident response evidence must include PDPL compliance steps.
  • ISO/IEC 27001:2022 Certification: Many organizations pursue dual certification. Map SAMA CSF controls to ISO 27001 control sets to streamline evidence collection and audit preparation.

Practical Next Steps

Security leaders should conduct a gap assessment against the SAMA CSF, prioritize controls by risk and regulatory urgency, and establish a continuous monitoring and evidence-collection program. Assign ownership for each control domain, set measurable KPIs, and report quarterly to the board on progress and risk exposure. Engage external auditors early to validate interpretation of framework requirements and to refine evidence collection methods.

Compliance is not a one-time project; it is an ongoing operational discipline. Organizations that treat the SAMA CSF as a strategic foundation—not a checkbox—will build resilience and maintain the trust of regulators, customers, and stakeholders.