SAMA Cyber Security Framework: What Regulated Entities Must Evidence

Who the framework applies to

The SAMA Cyber Security Framework was issued by the Saudi Central Bank (SAMA) to strengthen cyber resilience across the financial sector. It applies to SAMA-regulated member organisations, including banks, insurance and reinsurance companies, finance companies, credit bureaus and financial market infrastructure.

The framework is principle-based. It sets out what must be achieved and how maturity will be judged, and leaves organisations to decide how to implement controls appropriate to their size and risk.

The four domains

• Cyber Security Leadership and Governance — strategy, the cybersecurity function, committee, policy, roles, and cybersecurity within project management and human resources.
• Cyber Security Risk Management and Compliance — risk management processes, regulatory compliance, compliance with international standards, and cybersecurity review and audit.
• Cyber Security Operations and Technology — asset management, architecture, identity and access, application, change and infrastructure security, cryptography, BYOD, secure disposal, payment systems, e-banking, event management, incident management, threat management and vulnerability management.
• Third Party Cyber Security — contract and vendor management, outsourcing and cloud computing.

The maturity model

Member organisations are expected to achieve at least level 3 across the framework. Higher levels are appropriate where risk, size or criticality demand it.

What “level 3” really requires

Level 3 is often misunderstood as a technology target. It is a formalisation target. For each control area, reviewers look for four things:

• A documented policy, standard or procedure
• Formal approval by the appropriate authority
• Consistent implementation across the organisation
• Evidence that it is operating — records, logs, tickets, reports

A control that works well but is undocumented is level 2. A beautifully documented control that is not implemented is also not level 3. Both halves are required.

Building an evidence pack that stands up to review

• Map every requirement to an owner and a set of evidence items.
• Keep evidence current — undated screenshots and year-old reports undermine credibility.
• Show the governance trail: committee minutes, approvals and decisions.
• Demonstrate follow-through on audit and assessment findings.
• Maintain a clear record of third-party risk assessments and contractual security clauses.
• Align the pack with related SAMA requirements, such as business continuity and IT governance, to avoid duplicated effort.

Where organisations usually fall short

• Maturity self-assessments that are optimistic compared with the evidence.
• Strong technology controls with weak governance and documentation.
• Cybersecurity considered late in projects rather than built in.
• Incomplete oversight of cloud and outsourcing arrangements.
• Metrics collected but never used to drive improvement — which blocks progress beyond level 3.

Working with overlapping obligations

SAMA-regulated organisations often also answer to the NCA, PDPL, PCI DSS and international standards. Designing one control framework mapped to all of them allows a single test to satisfy several requirements, and gives leadership one coherent view of cyber risk instead of several competing ones.

Moving beyond level 3

Level 3 is the expected minimum, not the finish line. Moving to level 4 — managed and measurable — means controls are measured, reviewed and improved on the basis of evidence. In practice that requires key performance and risk indicators for important control areas, regular reporting to the cybersecurity committee, and documented decisions taken as a result.

For larger or more critical institutions, reaching level 4 in areas such as identity and access management, vulnerability management, event monitoring and third-party security gives leadership a measurable view of risk and demonstrates to SAMA that the programme is actively managed rather than periodically documented.

A practical cycle for sustaining maturity

• Perform an evidence-based maturity self-assessment at least annually.
• Agree target maturity levels by domain with the cybersecurity committee.
• Track remediation actions with owners and dates, and report progress quarterly.
• Update policies and procedures when business, technology or regulation changes.
• Commission independent review periodically to validate self-assessment results.

Frequently asked questions

NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.