The SAMA Cyber Security Framework, explained

A plain-English guide for the financial institutions that live by it.

If you run security, risk or technology for a financial institution regulated in the Kingdom of Saudi Arabia, the SAMA Cyber Security Framework is not a document you file and forget, or a snapshot taken once a year. It sets out the working principles behind how you are expected to govern, operate and evidence your security, every day. This guide explains what it is, who it applies to, how it is checked, and how to turn it from an obligation into something that builds trust with your regulator, your customers and your board.

What the SAMA CSF is

The SAMA Cyber Security Framework, usually shortened to SAMA CSF, is the cyber security rulebook issued by the Saudi Central Bank (SAMA, formerly the Saudi Arabian Monetary Authority) for the institutions it regulates, which it calls Member Organisations. Version 1.0 was issued in May 2017 and is still the version in force on the SAMA Rulebook. It replaced twelve earlier SAMA cyber security circulars, and it draws on international practice from NIST, ISO and others, but it is SAMA’s own document and SAMA alone interprets it.

Its purpose is simple. Financial institutions hold money, identity and trust on behalf of their customers. The framework gives every Member Organisation the same approach to protecting them, lifts each one to an acceptable level of maturity, and lets SAMA measure and compare them.

Why SAMA’s approach deserves credit

It is worth saying plainly: SAMA got a great deal right, and early. In 2017, when many regulators were still issuing checklists, the Saudi Central Bank published a single, consolidated framework built on a maturity model. It asks institutions not just whether a control exists but how well it is run, measured and improved. It puts ownership with the board, holds suppliers to the same standard as the institution itself, and has been extended since with companion guidance on cyber resilience for new entrants, threat intelligence and ethical red-teaming.

That vision sits at the heart of Saudi Vision 2030. SAMA has been a driving force in the Kingdom’s financial sector and is one of the bodies leading the Financial Sector Development Program, which aims for a diverse, effective financial sector that supports the national economy: more digital payments, wider financial inclusion and room for new fintech entrants. Its regulatory sandbox, fintech licensing and open banking work all serve that aim. A modern, open financial sector only works if people trust it, and a framework that measures maturity rather than ticking boxes is how you build that trust at national scale.

Who must comply

The framework is mandatory. Section 1.5 states that it “is mandated by SAMA”, and it applies to:

• all banks operating in Saudi Arabia;
• all insurance and reinsurance companies;
• all financing companies;
• all credit bureaus;
• the financial market infrastructure, with the Rulebook also listing payment systems, payment service providers and regulatory sandbox participants.

All four domains apply to banks. Other Member Organisations can exclude three subdomains: industry standards (unless they handle cardholder data or use SWIFT), payment systems, and electronic banking, though anyone offering online services still needs multi-factor authentication.

If you supply these institutions, expect the framework to reach you too. Domain 4 asks them to hold their third parties to the same level of protection, so their supplier questionnaires will ask you SAMA’s questions.

The four domains

SAMA CSF organises its requirements into four domains and 32 subdomains. Each domain answers a question the framework keeps asking:

1. Cyber Security Leadership and Governance: does the board own cyber security, with a committee, a strategy, policies, clear roles, and awareness and training?
2. Cyber Security Risk Management and Compliance: do you identify, treat and report cyber risk, and track the laws, regulations and standards you must meet?
3. Cyber Security Operations and Technology: are the day-to-day controls working, from asset management, identity and access, and change management to vulnerability management, monitoring and incident response?
4. Third Party Cyber Security: do you manage the risk your outsourcers, cloud providers and other suppliers bring in?

Domain 3 holds most of the technical work. Domain 1 is where reviews often find gaps, because board ownership is easy to assume and hard to evidence after the fact.

How compliance is checked: the maturity model

There is no SAMA CSF certificate. Each Member Organisation completes a periodic self-assessment, scoring itself on a six-level maturity model, and SAMA reviews and audits those self-assessments, decides the compliance and maturity level, and compares institutions with each other.

Level 3 is the minimum SAMA expects. Banks are held to level 4. To claim a level you must meet every criterion of the levels below it. Where a control can’t be implemented, you apply a compensating control, accept the risk internally and request a formal waiver from SAMA.

Notice what level 3 asks for: policies, standards and procedures that exist, are approved, are followed, and can be shown to be followed. Level 4 adds measurement. That is the difference between saying you are secure and being trusted to be.

SAMA’s own wording points the way. At level 3, it expects compliance to be monitored “preferably using a governance, risk and compliance tool (GRC)”. At level 5, it describes a programme focused on “continuous compliance”, supported with “automated real-time monitoring”.

SAMA CSF and NCA ECC

Many Saudi financial institutions also fall within the National Cybersecurity Authority’s scope, for example as operators of critical national infrastructure. If you do, the NCA Essential Cybersecurity Controls (ECC-2:2024) apply alongside SAMA CSF.

The two overlap heavily: an approved security policy, an asset inventory, awareness training and vulnerability management each answer requirements in both. So don’t run them as two projects. Map your controls once, record which framework each one answers, and gather the evidence once. Running them separately is how teams do the same work twice and still miss the connections.

A SAMA CSF checklist

Before your next self-assessment, check that you can answer yes to each of these:

1. Scope: you know which type of Member Organisation you are and which subdomains apply to you.
2. Governance: the board has mandated a cyber security committee with an approved charter, and a cyber security function independent of IT.
3. Documentation: a board-endorsed policy, with the standards and procedures beneath it, for every subdomain in scope.
4. Assets: an inventory of information assets, with owners and criticality, including what your subsidiaries and third parties hold for you.
5. Identity and access: multi-factor authentication where required, privileged accounts controlled, joiners, movers and leavers handled on time.
6. Vulnerabilities and monitoring: systems tested regularly, findings prioritised and tracked to closure, security events monitored.
7. Third parties: cyber security requirements in contracts, and suppliers assessed before and during the relationship.
8. Maturity: a score and evidence for every subdomain, at level 3 or above (level 4 for banks), with waivers documented where you need them.

From obligation to trust

The traditional route to SAMA CSF is a consultancy engagement, a spreadsheet and a scramble for evidence before each self-assessment. It works, but it is slow, it goes stale the day it is finished, and it leaves you depending on someone else to tell you where you stand.

There is a better pattern, and it maps neatly onto what the maturity model asks for:

• Formalise. Turn the framework into your own strategy, policies, standards and procedures, approved and owned by the right people. That is the heart of level 3.
• Practise. Check the controls against your real environment, continuously rather than once a year: your users, identities and privileges, your hardware and software, your cloud and your internet-facing services. That is what makes level 4 measurable.
• Build trust. Keep the evidence current, be clear about what is evidenced and what is only declared, and share it with the people who need to rely on it: SAMA, your internal audit, your board and your customers.

This is the approach 786 Cyber is built around. The SAMA CSF assessment scores every subdomain on SAMA’s own 0 to 5 scale, and AI drafts the supporting policies from your organisation’s context. Our security tooling tests what you actually run, on the schedule you set, so many answers come from live evidence, each marked evidenced or declared. Your evidence counts across SAMA CSF, NCA ECC and ISO 27001 where they genuinely overlap, and your reviewers can see it for themselves.

The takeaway

SAMA CSF is mandatory, maturity-based and best approached together with NCA ECC rather than on its own. The institutions that handle it well don’t treat it as paperwork for the self-assessment. They treat it as the structure for running security well every day, and keep the evidence ready. Do that, and the self-assessment becomes a by-product, and trust follows.

A personal note

Having worked with SAMA, directly and indirectly, over the last 20 years, I have been pleased to watch the framework, and the institutions it regulates, improve year after year. What stands out is SAMA's willingness to share knowledge: clear guidance, practical advice on adoption, and companion frameworks that help Member Organisations keep improving, not just pass a review. That serves its members, and it serves the public who rely on them.

We built 786 Cyber on similar principles. It was encouraging to see SAMA set that direction in the framework itself: compliance monitored "preferably using a governance, risk and compliance tool", and a path towards "continuous compliance" with "automated real-time monitoring". That is what we set out to build. SAMA CSF was one of the first frameworks we examined when we cross-mapped models, tooling and objectives, to make sure the platform delivers what the framework requires and adds value beyond it. We are honoured to offer SAMA Member Organisations an extended 30-day trial: just contact us and mention SAMA.

Frequently asked questions

Is SAMA CSF mandatory?

Yes. Section 1.5 of the framework states that it “is mandated by SAMA”. It applies to all banks operating in Saudi Arabia, all insurance and reinsurance companies, all financing companies, all credit bureaus and the financial market infrastructure, with the SAMA Rulebook also listing payment systems, payment service providers and regulatory sandbox participants.

What maturity level does SAMA require?

Level 3, structured and formalised, is the minimum SAMA expects. Banks are held to level 4, managed and measurable. Member Organisations score themselves on a six-level maturity model from 0 to 5, and to claim a level you must meet every criterion of the levels below it.