SAMA Cybersecurity Framework: A Practical Compliance Guide for Saudi Financial Institutions

The SAMA Cybersecurity Framework (SAMA CSF) is the Saudi Central Bank's mandatory cyber security standard for the financial institutions it regulates. Issued on 24 May 2017 under Circular No. 381000091275, it organises controls into four domains and uses a six-level maturity model (0 to 5). Every regulated organisation is expected to operate at Level 3 or higher.

What is the SAMA Cybersecurity Framework?

SAMA published Version 1.0 of its Cyber Security Framework in May 2017 to give banks, insurers and other regulated entities a common approach to managing cyber risk. The SAMA Rulebook lists the framework as in force. The Saudi Arabian Monetary Authority was renamed the Saudi Central Bank on 24 November 2020 but kept the acronym SAMA, so the framework name did not change.

Three features define it:

• Principle-based. Each subdomain states a principle, an objective and control considerations, rather than a rigid checklist.
• Built on international standards. SAMA drew on NIST, ISF, ISO, Basel and PCI requirements, so organisations already aligned with ISO 27001 or PCI DSS have a head start.
• Maturity-driven. Compliance is judged by how consistently and measurably a control operates, not only by whether a policy exists.

Where a control cannot be implemented, SAMA expects compensating controls, documented internal risk acceptance, or a formal waiver request.

Who must comply with the SAMA CSF?

The framework applies to SAMA-regulated "Member Organisations". The Rulebook lists its scope of application as the banking sector, the finance sector, payment systems and payment service providers, credit bureaus and the regulatory sandbox. SAMA's applicability section also names insurance and reinsurance companies, financing companies and financial market infrastructure.

All domains apply to banks. For other institutions SAMA excludes a small number of subdomains with conditions. Payment Systems (3.3.12) is excluded. Electronic Banking Services (3.3.13) is excluded, but multi-factor authentication is still expected for online customer services. Compliance with international industry standards (3.2.3) is excluded, though PCI DSS or the SWIFT Customer Security Controls Framework applies where cardholder data or SWIFT is involved.

Technology vendors, cloud providers and managed service partners are not directly regulated, but they feel the framework through the third-party domain: your bank client will flow its requirements into your contract.

What are the four domains of the SAMA CSF?

Domain	Subdomains	What reviewers typically look for
1. Cyber Security Leadership and Governance	Governance, strategy, policy, roles and responsibilities, cyber security in project management, awareness, training	Board-approved strategy, an independent CISO function, a cyber security committee, and evidence that security is built into projects
2. Cyber Security Risk Management and Compliance	Risk management, regulatory compliance, compliance with (inter)national industry standards, cyber security review, cyber security audits	A maintained risk register, periodic independent reviews and audits, tracked remediation
3. Cyber Security Operations and Technology	Human resources, physical security, asset management, architecture, identity and access management, application security, change management, infrastructure security, cryptography, BYOD, secure disposal, payment systems, electronic banking services, event management, incident management, threat management, vulnerability management	Privileged access control, MFA, logging and SOC monitoring, patching SLAs, tested incident response
4. Third Party Cyber Security	Contract and vendor management, outsourcing, cloud computing	Security clauses in contracts, vendor risk assessments, cloud approvals and exit plans

Domain 3 is by far the largest, with 17 subdomains, and is where most remediation effort lands. Cloud computing sits in Domain 4, which links directly to Saudi data residency rules covered in our cloud computing and data residency guide.

What are the SAMA CSF maturity levels?

SAMA's maturity model has six levels. Reaching Level 3, 4 or 5 requires meeting all criteria of the preceding levels.

Level	Name	What it looks like in practice
0	Non-existent	No control or awareness of the requirement
1	Ad-hoc	Some activity happens, but inconsistently and dependent on individuals
2	Repeatable but informal	The control is repeated, but not documented or approved
3	Structured and formalised	Documented, approved and implemented consistently. SAMA's minimum expectation
4	Managed and measurable	Effectiveness is measured with metrics and periodically evaluated
5	Adaptive	Continuous improvement driven by metrics, threat intelligence and lessons learned

A very common gap in maturity assessments is the jump from Level 2 to Level 3: the control works, but nobody can produce an approved document, an owner and evidence that it operates the same way every time.

How does SAMA CSF relate to the NCA Essential Cybersecurity Controls?

Many Saudi financial institutions must satisfy both SAMA and the National Cybersecurity Authority. NCA's Essential Cybersecurity Controls (ECC-2:2024) apply to government entities and to private organisations that own, operate or host Critical National Infrastructure.

Aspect	SAMA CSF	NCA ECC
Issuer	Saudi Central Bank (SAMA)	National Cybersecurity Authority
Current version	Version 1.0, May 2017	ECC-2:2024
Scope	SAMA-regulated financial institutions	Government entities and CNI operators; encouraged for all others
Structure	4 domains with principles, objectives and control considerations	4 main domains, 28 subdomains, 108 main controls, 92 subcontrols
Assessment style	Maturity levels 0–5, minimum Level 3	Compliance with each applicable control, assessed with NCA tools
Cloud	Subdomain 3.4.3 Cloud Computing	Subdomain 4-2 plus the separate Cloud Cybersecurity Controls (CCC)

The practical answer is a single control library mapped to both frameworks, so one piece of evidence satisfies both reviews. Our NCA ECC guide covers the NCA side in detail.

How is SAMA CSF compliance assessed?

1. Self-assessment. The organisation completes SAMA's periodic self-assessment questionnaire, rating maturity for each subdomain.
2. Evidence. Each rating must be backed by approved documents, records, configurations and metrics.
3. SAMA review and audit. SAMA reviews and audits self-assessments to determine compliance and maturity, and compares Member Organisations against each other.
4. Remediation. Gaps become a time-bound action plan, tracked by the cyber security committee and reported to senior management.

Be wary of claims that a new numbered version has replaced the 2017 framework. As of October 2026, the SAMA Rulebook lists the 2017 Cyber Security Framework as in force; always check the Rulebook directly rather than relying on vendor summaries.

What evidence do SAMA reviewers expect?

A maturity rating is only as strong as the evidence behind it. For each subdomain, prepare a short evidence index that points to the artefacts below.

• Governance: board or committee minutes approving the cyber security strategy, the CISO's mandate and reporting line, and the approved policy set with review dates.
• Risk and compliance: the cyber risk register, risk acceptance records signed at the right level, internal audit reports and the remediation tracker.
• Operations and technology: asset inventories, access reviews for privileged accounts, MFA coverage reports, SIEM use cases and alert handling records, vulnerability scan trends and patch compliance, incident response exercise reports.
• Third parties: vendor risk assessments, security clauses in contracts, outsourcing and cloud approvals, and exit plans for critical providers.

Evidence that systems generate automatically, such as dashboards and scheduled reports, is more convincing than documents prepared the week before a review, and it is also the foundation for Level 4.

What are the most common SAMA CSF pitfalls?

• Treating it as an IT project. The framework starts with board oversight and business ownership; without them Domain 1 stalls.
• Policies without owners. A policy that nobody maintains or measures will not survive a Level 3 review.
• Weak third-party clauses. Outsourcing and cloud contracts often lack audit rights, breach notification terms and data location commitments.
• Untested incident response. A plan that has never been exercised is a Level 2 control at best.
• No metrics. Without KPIs and KRIs there is no route to Level 4, and no early warning when controls drift.

The original framework document, including the control considerations for every subdomain, is available as the SAMA Cyber Security Framework PDF.

A practical SAMA CSF compliance roadmap

1. Confirm scope and governance. Identify applicable subdomains, appoint control owners and confirm the CISO's independence and reporting line.
2. Run a gap assessment. Rate current maturity per subdomain against the Level 3 criteria, with evidence, not opinion.
3. Prioritise by risk. Fix high-impact gaps first: privileged access, MFA, logging and monitoring, vulnerability management, third-party and cloud controls.
4. Formalise. Write or update policies, standards and procedures, get them approved and communicate them.
5. Implement and automate. Deploy the technical controls and automate evidence collection wherever possible.
6. Measure. Define KPIs and KRIs for each domain to move from Level 3 towards Level 4.
7. Prepare the self-assessment. Assemble the evidence pack, rehearse with an internal review, and track remediation openly.

Timelines depend on starting maturity and the size of the estate, so avoid fixed promises. What shortens the journey is architecture: security designed into identity, network and monitoring once, rather than patched system by system. We explain that approach in cybersecurity architecture for KSA enterprises, and our cloud migration case study shows centralised security posture with continuous NCA compliance monitoring.

Next step

If you are a bank, insurer, finance company or fintech preparing for a SAMA self-assessment, or a technology vendor serving one, start with an honest gap assessment. Amwaj Solutions designs NCA-aligned security architectures and helps teams build the evidence that maturity reviews require. See our cybersecurity and compliance services or contact us to scope a review.