SAMA Cybersecurity Framework (SAMA CSF): The Complete Guide for Saudi Financial Institutions

The SAMA Cybersecurity Framework (SAMA CSF) is the mandatory cybersecurity regulation issued by the Saudi Central Bank (formerly the Saudi Arabian Monetary Authority) for banks, insurance companies, finance companies, credit bureaus, and fintech startups operating in Saudi Arabia. If your organization is licensed or supervised by SAMA, compliance is not optional — and the framework applies to your entire technology estate, including cloud services and third-party providers.

This guide explains the framework's structure, who must comply, what examiners look for, and gives you a practical SAMA CSF checklist you can start using today. If you need help implementing it, our Riyadh-based SAMA CSF consulting team runs fixed-fee gap assessments scoped on a short discovery call.

What is the SAMA Cybersecurity Framework?

SAMA issued the Cyber Security Framework in May 2017 to set the minimum baseline for cybersecurity across the financial sector. It was the first sector-specific cybersecurity regulation of its kind in the region and remains the primary benchmark SAMA examiners use when assessing supervised entities.

The framework defines 29 sub-controls across 4 domains, with an associated maturity model that ranges from Level 0 (Non-existent) to Level 5 (Adaptive). SAMA expects member organizations to reach and maintain an appropriate target maturity level — in practice, Level 3 (Repeatable/Defined) is the widely accepted minimum for most institutions, with Level 2 as an interim floor for newly licensed entities in their first year.

Who must comply with SAMA CSF?

• Banks (local and branches of foreign banks)
• Insurance and reinsurance companies
• Finance companies (consumer finance, real estate finance, leasing)
• Credit bureaus
• Fintech companies licensed by SAMA (payments, digital banks, BNPL, Open Banking participants)
• Money exchange and remittance companies

Third-party service providers, cloud providers, and outsourcing partners that serve SAMA-regulated entities are not directly licensed by SAMA — but their security posture flows through the framework's third-party domain, which makes them contractually accountable to their regulated clients.

The 4 SAMA CSF domains and 29 sub-controls

Domain 1: Cyber Security Leadership and Governance (sub-controls 1.1–1.6)

Governance is where SAMA examiners start, and where most findings originate. This domain requires board-level accountability for cybersecurity, a documented strategy, a qualified CISO, and a defined cybersecurity organizational structure.

• 1.1 Cyber security strategy — a board-approved strategy aligned to business objectives, reviewed at least annually
• 1.2 Cyber security organizational structure — defined roles, responsibilities, and reporting lines with proper segregation of duties
• 1.3 Cyber security policies and procedures — an approved policy set covering all critical systems, reviewed regularly and version-controlled
• 1.4 Cyber security budget — adequate, ring-fenced budget allocated to implement the strategy
• 1.5 Cyber security human resources — qualified staff, defined headcount, awareness programs, and secure joining/leaving processes
• 1.6 Government initiatives and programs — participation in national cybersecurity initiatives where applicable

Domain 2: Cyber Security Risk Management and Compliance (sub-controls 2.1–2.6)

• 2.1 Risk management program — an enterprise cyber risk register with defined methodology, risk appetite, and treatment plans
• 2.2 Vulnerability management — regular scans and penetration tests on defined frequencies with tracked remediation
• 2.3 Cyber security in the project lifecycle — security requirements embedded in every project, from initiation to decommissioning
• 2.4 Regulatory compliance — a documented process to identify and comply with applicable cybersecurity regulations
• 2.5 Compliance with payment card industry requirements — PCI DSS where cardholder data is handled
• 2.6 Cyber security metrics — KPIs/KRIs reported to management and the board on a defined cadence

Domain 3: Cyber Security Operations and Technology (sub-controls 3.1–3.9)

The largest domain — covering the technical controls examiners test during assessments.

• 3.1 Network security — segmentation, firewalls, secure remote access, and network monitoring
• 3.2 Identity and access management — least privilege, privileged access management, multi-factor authentication
• 3.3 Data classification and protection — data classified by sensitivity and protected in transit and at rest
• 3.4 Physical and environmental security — protection of data centers, server rooms, and critical facilities
• 3.5 Cyber security event and incident management — detection, SIEM monitoring, documented incident response plan, and mandatory incident reporting to SAMA
• 3.6 Business continuity management — BCP/DR plans aligned to recovery objectives, with regular testing
• 3.7 Change and configuration management — controlled changes, hardened baselines, patch management
• 3.8 Cyber security awareness and training — regular, role-based awareness covering phishing and social engineering
• 3.9 Threat intelligence and SOC monitoring — threat intel feeds and a security operations capability proportionate to your risk

Domain 4: Third Party Cyber Security (sub-controls 4.1–4.3)

• 4.1 Third party cyber security risk management — due diligence, risk tiering, and ongoing monitoring of vendors and service providers
• 4.2 Outsourcing management — contracts with defined security clauses, audit rights, and exit strategies, aligned to SAMA's outsourcing rules
• 4.3 Cloud computing security — documented cloud risk assessment, data residency considerations, and alignment to SAMA's cloud framework expectations

The SAMA CSF maturity model

Level	Name	What it means
0	Non-existent	No processes or controls in place
1	Ad-hoc	Reactive, undocumented, dependent on individuals
2	Repeatable	Basic documented processes, inconsistently followed
3	Defined	Documented, approved, and consistently applied — the practical minimum for regulated entities
4	Managed	Measured with metrics, continuously monitored
5	Adaptive	Continuously improved based on threat landscape and lessons learned

Your target maturity level should be set per sub-control and approved by the board — not every sub-control requires Level 5, but critical systems generally require Level 3 or above.

SAMA CSF compliance checklist

Use this checklist to self-assess your readiness before a formal SAMA examination or a gap assessment. Score each item and record evidence locations.

Governance checklist

• Board-approved cybersecurity strategy dated within the last 12 months
• CISO appointed with defined mandate, direct reporting line, and adequate seniority
• Cybersecurity committee meeting at a defined cadence with minutes retained
• Complete policy set (acceptable use, access control, incident response, BC/DR, change management, third-party) — approved and version-controlled
• Annual cybersecurity budget approved and tracked against actual spend
• Role-based awareness training completed by all staff within the last 12 months, with phishing simulation results

Risk and compliance checklist

• Cyber risk register maintained with methodology, ownership, and treatment status
• Risk assessment performed within the last 12 months covering all critical systems
• Internal and external vulnerability scans on a defined schedule; penetration test within the last 12 months
• Remediation tracked to closure with SLAs by severity
• Security requirements embedded in the project intake process
• Cybersecurity KPIs/KRIs reported to management at least quarterly

Operations and technology checklist

• Network segmentation diagram current; external attack surface documented
• Privileged access reviewed at defined intervals; MFA enforced for remote access and admin functions
• Data classification standard in use; encryption applied to sensitive data at rest and in transit
• SOC or monitoring capability operating; log retention meets defined requirements
• Incident response plan tested within the last 12 months; SAMA incident reporting process documented (within the required timeline)
• BCP and DR plans tested within the last 12 months with documented results
• Change management records complete; patching cadence defined and met for critical systems

Third-party checklist

• Vendor inventory maintained with criticality tiering
• Security due diligence performed before onboarding critical vendors
• Contracts include security requirements, audit rights, breach notification, and exit provisions
• Critical vendors reviewed on a defined cycle
• Cloud services risk-assessed, with data residency and SAMA cloud expectations addressed

Scoring guide

• 90–100% complete: examination-ready; maintain evidence hygiene
• 70–89%: close gaps within one quarter; prioritize incident reporting and access management
• Below 70%: commission a formal gap assessment and a remediation roadmap before your next examination window

How SAMA examinations work (and what triggers them)

SAMA conducts cybersecurity examinations on its own schedule and after major incidents. Examiners typically request your strategy, policies, risk register, incident records, and evidence of testing — then interview staff to verify processes are actually followed, not just documented. Institutions that fail examinations face supervisory action, and repeat findings escalate.

The most common findings we see in practice: outdated risk registers, untested incident response plans, missing board-level metrics, third-party contracts without security clauses, and incomplete awareness training records.

How long does SAMA CSF compliance take?

For a mid-sized institution starting from an informal level, a structured program typically takes 4–9 months to reach a defensible Level 3: roughly 2–3 weeks for the gap assessment, 1–2 months for governance and policy remediation, and 2–5 months for technical control implementation and evidence collection. The timeline depends heavily on your starting maturity and how much of the estate is already aligned to ISO 27001 or NCA ECC — both map substantially onto SAMA CSF requirements.

How CyberInTech helps with SAMA CSF compliance

We are a Riyadh-based consultancy that works with Saudi regulatory frameworks daily. Our SAMA CSF consulting covers:

• Gap assessment against all 29 sub-controls with maturity scoring and a risk-ranked remediation roadmap
• Remediation support — policy development, control implementation, and evidence preparation
• Examination readiness — mock examinations, evidence organization, and staff briefing
• Third-party and cloud alignment — vendor programs that satisfy both SAMA CSF and SAMA outsourcing rules

Request a consultation — engagements are fixed-fee after a short discovery call, and fees are scoped on discovery so you know the number before you commit.

Frequently asked questions

Is SAMA CSF mandatory?

Yes — for entities licensed or supervised by SAMA. Compliance is enforced through SAMA's examination process, and significant findings can result in supervisory action.

What is the difference between SAMA CSF and NCA ECC?

NCA ECC applies broadly to national critical infrastructure and government entities, while SAMA CSF is specific to the financial sector. SAMA CSF is generally considered more prescriptive for financial institutions, and the two frameworks overlap heavily — organizations mapped to both can reuse most evidence. See our guide to Saudi cybersecurity frameworks for a full comparison.

What maturity level do we need?

SAMA does not publish a single mandatory number for all entities, but Level 3 (Defined) is the widely accepted minimum benchmark for established institutions, with Level 2 tolerated only as an interim state for newly licensed firms.

How often must we assess compliance?

Best practice — and examiner expectation — is at least annually, with continuous monitoring in between. Material changes to your environment or major incidents should trigger an out-of-cycle review.