How to Reach SAMA Cyber Security Framework Maturity Level 3
Reaching SAMA Cyber Security Framework (CSF) maturity level 3 means your cyber security controls are defined, approved, implemented in a structured and formalised way, and demonstrably operating - with policies, standards and procedures in place, compliance monitored, and KPIs reported. It is not a certificate any consultant can stamp on a slide; it is an evidenced operating state against SAMA's maturity model.
Start with evidence, not templates
If your bank, insurer, finance company, fintech or supplier programme is aiming at Level 3, start with a scoped gap assessment, then close gaps with owners and sampleable proof. Full service context: SAMA CSF consulting.
Guide highlights
- What Level 3 means in SAMA terms
- Level 2 vs 3 vs 4 differences
- Practical path and sequencing
- Evidence assessors actually sample
What maturity level 3 means in the SAMA CSF
SAMA's Cyber Security Framework includes a Cyber Security Maturity Model with six levels: 0 through 5. To achieve levels 3, 4 or 5, a Member Organisation must first meet all criteria of the preceding levels.
| Level | Label (SAMA) | Core idea |
|---|---|---|
| 0 | Non-existent | No documentation; no awareness/attention for the control |
| 1 | Ad-hoc | Partially defined; inconsistent execution |
| 2 | Repeatable but informal | Repeatable practice, but not formally defined/approved |
| 3 | Structured and formalized | Controls defined, approved, implemented; implementation can be demonstrated |
| 4 | Managed and measurable | Effectiveness periodically assessed and improved; documented |
| 5 | Adaptive | Continuous improvement; integrated with enterprise risk management |
For Level 3, SAMA's explanation emphasises that:
- Cyber security controls are defined, approved and implemented in a structured and formalised way
- Implementation can be demonstrated
- Policies, standards and procedures are established
- Compliance with that documentation is monitored (preferably using a GRC tool)
- Key performance indicators are defined, monitored and reported to evaluate implementation
SAMA's maturity model objective states that Member Organisations should at least operate at maturity level 3 or higher. Separate SAMA circulars have also directed banks toward Level 3 roadmaps historically, with higher targets on specific subdomains over time - always confirm the circulars and edition that apply to your entity type.
Level 3 documentation, in SAMA's Level 3 detail, should make clear why (policy, board-endorsed), what (standards / baselines), and how (procedures) controls are implemented.
Who this guide is for
SAMA-supervised entities
Banks, insurers and finance companies building or remediating toward Level 3.
Fintechs and suppliers
Must show CSF-aligned maturity to SAMA, banks or partners - depth still scoped to your entity.
CISOs, GRC and IT leads
Need an evidence-led path, not a template dump.
Not for
Buyers who want a "Level 3 certificate" with no control operation, or guaranteed supervisory outcomes no consultant can honestly promise.
How Level 3 differs from Levels 2 and 4
- Versus Level 2: Level 2 may have repeatable habits; Level 3 requires formal policy/standard/procedure, approval, demonstrable implementation, monitoring of compliance, and KPIs. Informal tribal knowledge fails Level 3 sampling.
- Versus Level 4: Level 4 adds periodic effectiveness measurement, KRIs/trends, and documented improvement. Do not skip Level 3 foundations and claim Level 4 theatre.
Many programmes stall because they buy tools (aiming at Level 4 dashboards) before Level 3 documentation and ownership exist.
Practical path to Level 3
Confirm scope and target
Identify which CSF domains/subdomains apply, whether BCM linkages are in scope, and whether any circular sets a higher bar on specific subdomains. Confirm entity type - review depth differs.
Run a maturity-oriented gap assessment
Assess each in-scope control area against the maturity definitions - not only "policy exists." Sample whether standards and procedures exist, whether controls operate, whether compliance is monitored, and whether KPIs exist and are reported. Start: cybersecurity gap assessment.
Build the why / what / how stack
Policy (why), standards (what), procedures (how). Documents must match how teams actually work, or evidence will contradict them.
Implement and assign owners
Every control needs a named owner, operating rhythm, and success criteria. Roadmaps without owners die after the workshop.
Make implementation demonstrable
Configs, tickets, access reviews, test reports, training records, incident tickets, backup restoration tests. "We have a policy" is Level-2-adjacent thinking.
Monitor compliance and report KPIs
Define monitoring (GRC tool preferred in SAMA's wording; the requirement is monitoring). Define KPIs and report them to the audience your governance model requires.
Validate before review
Walk the gap register, re-sample evidence, close critical gaps, coach management on what can honestly be claimed.
What "demonstrable implementation" looks like in practice
Level 3 fails most often on sampling, not on missing Word documents. Typical artefacts:
- Approved policy with version history and board or designated committee endorsement
- Standards that set measurable baselines (password length/history, MFA rules, log retention, backup frequency)
- Procedures with who-does-what steps, not generic slogans
- Access review completions, joiner-mover-leaver tickets, privileged access approvals
- Vulnerability scan cycles, patch evidence, and penetration-test reports with closure tracking where required
- Security event monitoring evidence and incident tickets with timelines
- Backup jobs plus restoration test records
- Awareness completion records tied to roles
- KPI pack: definitions, data source, last reported period, exceptions
If any of those are "planned" but not operated, you are closer to Level 2 than Level 3 - even if the policy PDF looks polished.
Sequencing remediation without wasting budget
Governance and ownership
CISO/cyber function clarity, RACI, policy endorsement path.
Identity and privileged access
Because almost every other control depends on who can change what.
Logging, monitoring and incident
So events become evidence, not folklore.
Vulnerability and change
Reduce uncontrolled drift while you formalise standards.
Resilience linkages
BCP/DRP and backups where CSF/BCM expectations connect.
Third-party and application security
Often questionnaire-heavy for fintechs and suppliers.
KPI and compliance monitoring
Stand up reporting once the operating rhythm exists.
Multi-framework note (SAMA + NCA + ISO)
Many Saudi financial-sector programmes also face NCA ECC themes, PDPL expectations, or ISO/IEC 27001 certification paths. Overlaps in IAM, logging, risk and supplier controls are real - but maturity Level 3 is a SAMA CSF construct. Map overlaps to avoid duplicate remediation; do not assume an ISO certificate equals CSF Level 3. For ECC context see NCA ECC consulting.
Common mistakes that block Level 3
- Policies without standards/procedures - incomplete why/what/how
- Copy-paste ISO artefacts - useful overlap; SAMA language and evidence needs still differ
- Tool-first programmes - SIEM/IAM purchased before ownership and process
- One maturity claim for all entities - fintech questionnaire depth is not a full bank review
- No monitoring or KPIs - formal docs alone do not satisfy Level 3's monitoring/KPI expectations
- Ignoring BCM linkages where BCM is in regulatory scope
- Promising a certificate - maturity is assessed against SAMA's model; consultants support readiness, they do not replace SAMA
How CyberInTech helps
We assess current maturity against applicable SAMA CSF domains, produce a risk-ranked remediation roadmap toward your Level 3 target, and support control and evidence uplift with your teams. Delivery experience: 2 SAMA engagements, plus 5 CST, 2 ISO/IEC 27001, 4 ERP, 3 complex low-current projects. Fees scoped on discovery. We are not a regulator or certification body and do not claim "approved consultant" status by default.
Engagement pattern: discovery - assess - findings workshop - remediate - validate. Details: SAMA CSF consulting.
FAQ
What is SAMA CSF maturity level 3?
Level 3 is labelled Structured and formalized: controls are defined, approved and implemented so implementation can be demonstrated; policies, standards and procedures exist; compliance is monitored; and KPIs are defined, monitored and reported. Source: SAMA Cyber Security Maturity Model.
Is Level 3 the minimum SAMA expects?
SAMA's maturity model states Member Organisations should at least operate at maturity level 3 or higher. Specific circulars may set roadmaps or higher targets on named subdomains - confirm what applies to your entity.
How long does it take to reach Level 3?
It depends on starting maturity, scope and remediation capacity. Many organisations need a phased programme measured in months. A gap assessment first produces a realistic timeline.
Do we need a GRC tool to reach Level 3?
SAMA's Level 3 text says compliance monitoring is preferably performed using a GRC tool. The mandatory idea is monitored compliance and KPIs - tool choice is secondary to operating the process.
Should we do a gap assessment before remediation?
Yes, in most cases. Otherwise you risk buying tools and writing policies that do not move maturity.
Can CyberInTech certify us at Level 3?
No. CyberInTech supports assessment, remediation and evidence readiness. SAMA and applicable assessors evaluate maturity. CyberInTech does not sell Level 3 certificates.
How does fintech Level 3 work differ from banks?
Banks usually face deeper supervisory cycles. Fintechs often need CSF-aligned maturity for licensing partners or questionnaires - still evidence-heavy, but scoped differently. Clarify on discovery.
What are typical Level 3 deliverables in a consulting engagement?
Gap register with maturity ratings, prioritised roadmap, scoped policy/standard/procedure artefacts, evidence checklist, KPI suggestions, and open-actions list - confirmed on discovery. Fees scoped on discovery.
Related pages
Next step
Share your entity type, current self-assessed maturity (if any), deadline, and whether BCM is in scope. Our Riyadh team will outline a practical Level 3 plan - fees scoped on discovery. Call +966 531 446 716 or email info@cyberintech.com.
Contact CyberInTech