Gray Hat Security (GHS) logo

SAMA CSF · Financial Sector · Maturity Model

SAMA Cyber Security Framework (CSF): The Complete Guide for Saudi Financial Institutions (2026)

July 7, 2026 · 10 min read · GHS Security Team SAMA CSF Maturity Model Financial Sector

Quick Answer

The SAMA Cyber Security Framework (CSF) is the mandatory cybersecurity framework issued by the Saudi Central Bank (SAMA), applicable to banks, insurers, financing companies, payment service providers, and financial market infrastructure entities. First published in May 2017, it is organized into four core domains, each containing sub-domains and individual controls, and assessed through a 0–5 maturity model. Every domain must reach at least level 3 ("Defined") to be considered compliant.

Ahead of the 2026 audit cycle, SAMA issued updated guidance in Q4 2025 tightening residual-risk acceptance, making third-party assurance mandatory, moving Tier-1 board reporting to a semi-annual cadence, and aligning more closely with NCA's Essential Cybersecurity Controls to reduce duplicate reporting for dual-regulated institutions.

For every SAMA-regulated entity in the Kingdom, the Cyber Security Framework is not one compliance obligation among many — it is the primary lens through which the regulator views your cybersecurity posture. Understanding its structure, its maturity model, and what changed heading into the 2026 audit cycle is essential for CISOs, boards, and compliance leads across Saudi banks, insurers, and payment providers. This guide covers all three, plus a practical roadmap to reach and sustain the required maturity bar.

What Is the SAMA Cyber Security Framework and Who Must Comply?

The SAMA Cyber Security Framework (CSF) is issued by the Saudi Central Bank (SAMA) — the regulator overseeing banks, insurance and reinsurance companies, financing companies, payment service providers, and financial market infrastructure entities across the Kingdom. Compliance is mandatory for every entity SAMA regulates, regardless of size, and forms a core part of the regulator's supervisory review process.

Unlike a voluntary best-practice guide, SAMA CSF functions as a baseline: it defines the minimum acceptable cybersecurity posture a regulated entity must demonstrate, and it gives SAMA a standardized way to compare maturity across the sector.

What Is the History and Update Cadence of SAMA CSF?

SAMA CSF was first published in May 2017 and has been periodically updated since to keep pace with the evolving threat landscape and with international standards it draws from. Most recently, SAMA issued updated framework guidance in Q4 2025, ahead of the 2026 audit and enforcement cycle — a signal that regulated entities should treat the framework as a living document requiring continuous monitoring, not a one-time reference implemented once and left unchanged.

How Is the SAMA CSF Structured?

The framework is organized hierarchically:

  • →Four core domains — the top-level structure covering the full scope of cybersecurity governance and operations expected of a regulated entity.
  • →Sub-domains — each domain breaks down into a set of sub-domains representing specific capability areas within that domain.
  • →Individual controls — each sub-domain contains the granular controls that are actually assessed and scored during a SAMA examination.

Every domain must be assessed as part of a compliance review — there is no partial-scope option. This structure is what makes SAMA CSF assessments comprehensive but also demanding: a strong score in one domain does not offset a weak score in another.

How Does the 0–5 Maturity Model Work?

Rather than a binary pass/fail, SAMA CSF assesses every control on a maturity scale from 0 to 5. An organization must achieve a minimum maturity level of 3 ("Defined") across every domain to be considered compliant — reaching level 3 in most domains while falling short in even one is not sufficient.

Level Label What It Means in Practice
0 Non-Existent No documented process or control activity exists
1 Initial Ad-hoc, inconsistent activity with no formal documentation
2 Repeatable Activity follows a pattern but is not formally documented or standardized
3 Defined (minimum required) Controls are formally documented, approved, and consistently applied across the organization
4 Managed Controls are actively monitored, with metrics and periodic effectiveness reviews
5 Optimized Controls are continuously improved using data-driven insight and embedded in the organization's risk culture

Reaching level 3 satisfies the compliance floor. Levels 4 and 5 are not required for baseline compliance, but institutions with higher risk exposure — particularly Tier-1 banks — are increasingly expected to demonstrate progress toward level 4 as part of ongoing supervisory dialogue.

What's New in the 2026 SAMA CSF Update?

The Q4 2025 guidance introduced several changes that regulated entities should build into their 2026 compliance planning:

  • →Stricter residual-risk acceptance. There is now less room for regulated entities to simply "accept" unmitigated risk without documented justification and senior sign-off — risk acceptance decisions face closer scrutiny during examinations.
  • →Mandatory third-party assurance. Regulated entities must now obtain independent assurance over their vendors' security posture — a shift from advisory guidance to a mandatory program element, not merely a recommendation to include in vendor contracts.
  • →Semi-annual board reporting. Board-level cybersecurity reporting cadence has tightened from annual to semi-annual for Tier-1 institutions, requiring more frequent, structured reporting mechanics.
  • →Closer NCA ECC alignment. SAMA CSF and NCA's Essential Cybersecurity Controls are now more closely aligned specifically to reduce duplicate reporting burden for banks that are dual-regulated under both authorities.

GHS Perspective

The mandatory third-party assurance requirement is the change most Saudi financial institutions are underprepared for heading into 2026. Many regulated entities have vendor risk questionnaires but no structured, independent assurance program capable of producing defensible evidence during a SAMA examination. Building that program now — rather than reacting during the next audit cycle — is the highest-leverage action a compliance team can take this year.

What Does a Practical Roadmap to Maturity Level 3+ Look Like?

Reaching and sustaining a minimum maturity level of 3 across every domain requires a structured, ongoing program rather than a pre-audit scramble:

  • →Self-assessment cadence. Run internal maturity self-assessments at least twice a year, ahead of any formal SAMA examination, so gaps are identified and remediated on your own timeline.
  • →Evidence management. Maintain a living evidence repository mapped to each control — policy documents, monitoring logs, review records — rather than reconstructing evidence reactively when an examination is announced.
  • →Third-party assurance program. Stand up a formal, independent assurance process over critical vendors, with defined scope, cadence, and reporting — directly addressing the 2026 mandatory requirement.
  • →Board reporting mechanics. Build the semi-annual board reporting package around a consistent template — maturity scores by domain, residual risk register status, and third-party assurance findings — so reporting cadence changes don't require rebuilding the process each cycle.

Because SAMA CSF, NCA ECC, and ISO 27001 controls overlap substantially, institutions that centralize evidence and control mapping across all three frameworks in a single system — such as ComplyOS — spend materially less time on duplicate audit preparation each cycle. GHS's GRC advisory team supports regulated entities through self-assessment, gap remediation, and third-party assurance program design specifically for the SAMA CSF maturity model.

Frequently Asked Questions: SAMA Cyber Security Framework

The SAMA Cyber Security Framework (CSF) is a cybersecurity governance framework issued by the Saudi Central Bank (SAMA) that establishes the mandatory baseline for how banks, insurance and reinsurance companies, financing companies, payment service providers, and financial market infrastructure entities in Saudi Arabia must implement, measure, and continually improve their cybersecurity posture.
Compliance is mandatory for all entities regulated by SAMA, including banks, insurance and reinsurance companies, financing companies, payment service providers, and financial market infrastructure entities operating in the Kingdom of Saudi Arabia.
SAMA CSF assesses compliance using a maturity model that scores each individual control from 0 to 5. Every domain within the framework must be assessed, and an organization must achieve a minimum maturity level of 3, described as "Defined," across all domains to be considered compliant.
Key 2026-cycle developments include stricter language around residual-risk acceptance, third-party assurance moving from advisory to mandatory for vendor security posture, board-level cybersecurity reporting cadence tightening from annual to semi-annual for Tier-1 institutions, and closer alignment between SAMA CSF and NCA's Essential Cybersecurity Controls to reduce duplicate reporting for dual-regulated banks.
Level 3 ("Defined") means controls are formally documented, approved, and consistently applied across the organization — the minimum required for compliance. Level 4 ("Managed") means controls are actively monitored with metrics and periodic effectiveness reviews. Level 5 ("Optimized") means controls are continuously improved based on data-driven insights and are integrated into the organization's broader risk management culture.
SAMA Cyber Security Framework SAMA CSF Maturity Model Saudi Financial Sector Third-Party Assurance NCA ECC Alignment

Assess Your SAMA CSF Maturity

GHS runs SAMA CSF maturity self-assessments across all four domains and helps regulated entities build the third-party assurance and board reporting programs required for the 2026 cycle.

Book a Free Assessment →