SAMA Cyber Security Framework for Saudi financial institutions
SAMA Cyber Security Framework: what it requires and how to evidence it
Who the Saudi Central Bank framework applies to, its four domains, the maturity level SAMA expects, how self-assessment works, and where it overlaps with the NCA Essential Cybersecurity Controls.
In short
The SAMA Cyber Security Framework is the Saudi Central Bank's mandatory cybersecurity framework for the financial institutions it regulates. It is organised into four domains (leadership and governance, risk management and compliance, operations and technology, and third-party cyber security) and measured on a maturity model from Level 0 to Level 5. SAMA expects every Member Organization to operate at Level 3 or higher. Institutions assess themselves and SAMA reviews and audits the results.
Who has to comply with the SAMA framework?
The framework applies to SAMA Member Organizations: banks operating in Saudi Arabia, insurance and reinsurance companies, finance companies, credit bureaus and financial market infrastructure. All domains apply to banks. For the other sectors, the framework itself lists the parts that do not apply.
It is a regulatory requirement. SAMA publishes it in its Rulebook alongside the related documents it has issued since, such as the Cyber Resilience Fundamental Requirements and the Cyber Threat Intelligence Principles.
- Member Organization
- A financial institution regulated by SAMA and in scope of the framework: banks, insurers, reinsurers, finance companies, credit bureaus and financial market infrastructure.
- Maturity level
- A rating from 0 (non-existent) to 5 (adaptive) that describes how established a cyber security control is, from undocumented practice to continuously improved and measured.
- Self-assessment
- The institution's own evaluation of its maturity against each part of the framework. SAMA reviews these assessments and can audit them.
The four domains of the framework
SAMA organises the framework into four domains. Each domain is broken into subdomains, and each subdomain states a principle, an objective and the control considerations an institution is expected to address.
| Domain | What it covers |
|---|---|
| Cyber security leadership and governance | Strategy, the cyber security committee and function, policies, roles and responsibilities, awareness and training, and cyber security in projects |
| Cyber security risk management and compliance | Identifying, assessing and treating cyber risk; regulatory compliance; and internal and external review and audit of cyber security |
| Cyber security operations and technology | Asset management, identity and access, application and infrastructure security, cryptography, change management, monitoring, incident management and threat management |
| Third-party cyber security | Cyber security requirements in contracts and services with third parties, including outsourcing and cloud |
SAMA states that the framework draws on its own requirements and on industry standards including NIST, ISF, ISO, BASEL and PCI. Institutions that process cardholder data or use SWIFT are also expected to implement PCI DSS or the SWIFT Customer Security Controls Framework.
The maturity model and the level SAMA expects
The framework has no pass or fail. Each control area is rated on six maturity levels, and SAMA states that Member Organizations should operate at maturity level 3 or higher. SAMA later issued Maturity Level 4 requirements for banks and asked them for a roadmap to reach it.
| Level | Name | What it means in practice |
|---|---|---|
| 0 | Non-existent | No documented control or practice is in place |
| 1 | Ad hoc | The control exists but is applied inconsistently and is not documented |
| 2 | Repeatable but informal | The control is applied repeatably, but without formal documentation or approval |
| 3 | Structured and formalised | The control is documented, approved and implemented consistently. The minimum SAMA expects. |
| 4 | Managed and measurable | The control's effectiveness is measured and reviewed periodically |
| 5 | Adaptive | The control is continuously improved based on measurement and changing threats |
When the NCA Essential Cybersecurity Controls apply as well
The National Cybersecurity Authority (NCA) publishes its own mandatory control set, the Essential Cybersecurity Controls. The current version, ECC-2:2024, replaced ECC-1:2018 and applies to government agencies, their affiliated companies, and private-sector organisations that own, operate or host critical national infrastructure.
Some financial institutions fall under both. The two regulators publish separate frameworks in different terminology and neither defers to the other, so an institution in scope of both answers two assessments of largely the same controls.
| SAMA Cyber Security Framework | NCA ECC-2:2024 | |
|---|---|---|
| Issued by | Saudi Central Bank | National Cybersecurity Authority |
| Applies to | SAMA Member Organizations | Government entities, their affiliates and critical national infrastructure operators |
| Structure | Four domains, broken into subdomains | Four domains, 28 subdomains, 108 main controls and 92 subcontrols |
| Measured by | Maturity levels 0 to 5, minimum Level 3 | Compliance with each control |
| Assessment | Self-assessment reviewed and audited by SAMA | Self-assessment, NCA reporting tool and on-site audits |
Most institutions in this position run one set of controls, map each to the SAMA subdomain and the ECC control it satisfies, and keep one body of evidence behind them. You will need to check that mapping yourself, because the two frameworks group requirements differently and some ECC controls have no direct SAMA counterpart.
Third-party cyber security is a domain of its own
SAMA gives third parties a full domain rather than a single control. Institutions are expected to set cyber security requirements in contracts, assess third parties before and during the relationship, and manage the specific risks of outsourcing and cloud services.
- Before the contract. Assess the third party's cyber security and record the requirements the contract must contain.
- In the contract. Security requirements, the right to review or audit, and incident notification obligations.
- During the relationship. Periodic reassessment, proportionate to how critical the service is.
- Outsourcing and cloud. Additional requirements where services or data move to an outsourced or cloud provider.
Notifying SAMA about cyber security incidents
Incident management sits in the operations and technology domain. Medium and high classified incidents carry notification duties to SAMA that run alongside the institution's own response.
| Stage | When | What it involves |
|---|---|---|
| Initial notice | Immediately, for a medium or high classified incident | Inform SAMA that the incident has been identified |
| Approval | Before any media contact about the incident | Obtain SAMA's approval before communicating with the media |
| Formal report | After operations have resumed | Submit a formal incident report to SAMA |
Check the current Rulebook and any circulars your institution has received for the exact classification criteria and report content.
Building a SAMA framework programme
Most institutions start from controls they already run for ISO 27001 or PCI DSS. The work is mapping them to the framework, filling the gaps, and producing the documentation that moves each area to Level 3.
-
01
Confirm scope
Confirm which domains apply to your sector and whether the NCA ECC also applies to you.
Your CISO and compliance function
-
02
Assess current maturity
Rate each subdomain against the maturity model and record the evidence behind each rating.
Your cyber security function, in Certifyi
-
03
Map existing controls
Link the controls you already run for ISO 27001, PCI DSS or SWIFT CSCF to the SAMA requirements they satisfy, so the evidence is reused.
Your compliance team, in Certifyi
-
04
Close the gaps to Level 3
Write and approve the missing policies and procedures, assign owners and collect the evidence that each control is applied consistently.
Control owners across the institution
-
05
Prepare for review
Keep the self-assessment, evidence and remediation plan current for SAMA's review and audit.
Your compliance function and internal audit
Who does what
SAMA supervises the framework. The institution owns its controls and its self-assessment, and Certifyi keeps the record of both.
| Task | Your team | Certifyi | SAMA |
|---|---|---|---|
| Cyber security governance | Set the strategy, committee and policies, with board oversight | Holds policies, owners, approvals and review dates | Reviews governance during supervision |
| Maturity self-assessment | Rate each area and keep the evidence | Keeps requirements, ratings you record and linked evidence together | Reviews and audits the self-assessment |
| Third-party cyber security | Assess and monitor third parties | Records vendor intake and risk assessments | Examines third-party arrangements |
| Incident management | Classify, respond and notify | Records incidents and tracks SAMA notification stages | Receives notices and formal reports |
How Certifyi helps
Run the SAMA framework on the controls you already have
Certifyi does not assess your maturity for you or submit anything to SAMA. It holds the framework, your controls, the evidence behind them and the records of how each area is managed.
-
SAMA CSF in the framework catalogue
The four domains broken into subdomains, with 80 principle-level requirements to map your controls against.
-
One control set across frameworks
Map a control once to SAMA, ISO 27001 and PCI DSS, and reuse the mapping across frameworks. See the unified frameworks module.
-
Third-party cyber security
Run vendor intake and risk assessments in the vendor risk module. Suppliers answer through their own portal rather than by email.
-
SAMA incident notification stages
Incidents track SAMA's initial notice, media approval and formal report stages in the incident module.
-
Risk and review records
A risk register with heatmaps, recorded management reviews, and PDF reports for your committee.
Questions
SAMA Cyber Security Framework, answered
Is the SAMA Cyber Security Framework mandatory?
Yes, for SAMA Member Organizations: banks, insurers and reinsurers, finance companies, credit bureaus and financial market infrastructure regulated by the Saudi Central Bank. It is published in the SAMA Rulebook.
What maturity level does SAMA require?
SAMA states that Member Organizations should operate at maturity level 3 or higher. It has also issued Maturity Level 4 requirements for banks.
Is there a SAMA certification?
No. Institutions carry out a self-assessment, and SAMA reviews and audits it. There is no certificate to obtain.
What is the latest version of the SAMA framework?
The Rulebook lists the Cyber Security Framework Version 1.0, issued in May 2017. SAMA has since published related documents, such as the Cyber Resilience Fundamental Requirements, which sit alongside it.
Do we also need to comply with NCA ECC?
If your institution is a government entity or affiliate, or owns, operates or hosts critical national infrastructure, the NCA Essential Cybersecurity Controls (ECC-2:2024) apply as well. Many controls overlap, but the two are assessed separately.
How does the SAMA framework relate to ISO 27001?
SAMA states the framework draws on ISO, NIST, ISF, BASEL and PCI. Controls you run for ISO 27001 can satisfy many SAMA requirements, but the maturity model asks how established each control is, which ISO certification does not measure.
Does Certifyi make us SAMA compliant?
No. Compliance depends on your controls, your governance and SAMA's review. Certifyi is where the framework, your controls, evidence, vendors and incidents are kept and reported on.
Map your SAMA framework controls in a 30-minute call.
Bring your latest self-assessment or your ISO 27001 control set. We will show how SAMA requirements, evidence and third-party assessments sit together in Certifyi.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them