SAMA Cybersecurity Framework (CSF): Complete Compliance Guide for Saudi Financial Institutions
The SAMA Cybersecurity Framework (CSF) is a mandatory regulatory framework published by the Saudi Central Bank in May 2017. It applies to all SAMA-regulated financial institutions โ banks, insurers, financing companies, credit bureaus, and fintechs. Built on 4 domains and 6 maturity levels, it mandates a minimum of Level 3 (Defined) compliance for all member organizations. Based on NIST CSF, ISO 27001, PCI DSS, and Basel standards, it is the primary cybersecurity law for Saudi Arabia’s entire financial sector.
The Saudi financial sector is one of the most actively targeted in the Middle East for cyberattacks โ and the SAMA Cybersecurity Framework (SAMA CSF) is the Kingdom’s comprehensive response. Published in May 2017 by the Saudi Central Bank (SAMA) and mandatory for all regulated entities, the framework provides a structured, risk-based approach to cybersecurity that every bank, insurer, financing company, and fintech operating in the Kingdom must implement.
This guide covers everything: what the SAMA CSF is, exactly who must comply, the four domains in detail, how the six maturity levels work, the compliance process step by step, how it compares to ISO 27001, and how GHS helps Saudi financial institutions build a credible path to Level 3+ compliance.
Saudi Central Bank
0 through 5
for all members
๐ What Is the SAMA Cybersecurity Framework?
The SAMA Cybersecurity Framework (CSF) was established by the Saudi Arabian Monetary Authority โ Saudi Arabia’s central bank โ to enable financial institutions regulated by SAMA to effectively identify, assess, and manage cybersecurity risks. Unlike many jurisdictions where cybersecurity guidance is voluntary, SAMA’s framework is mandatory, not advisory. SAMA realized early that voluntary adoption would not produce consistent sector-wide cyber resilience, so compliance is enforced and progress is reported to SAMA directly.
The framework is principle-based and risk-based, meaning it sets clear objectives and minimum standards, but allows organizations to implement controls proportionate to their risk profile and operational complexity. It is built upon internationally recognized standards including:
- ๐ NIST Cybersecurity Framework (NIST CSF) โ the primary reference for the framework’s structure and risk management approach
- ๐ ISO 27001 / ISO 27002 โ international information security management standards that underpin the governance and control requirements
- ๐ณ PCI DSS โ payment card industry security standards, particularly relevant for payment processing entities
- ๐ฆ Basel II / III โ international banking supervision frameworks addressing operational risk
- ๐ ISF Standards of Good Practice โ practical guidance on information security across financial organizations
SAMA periodically reviews and updates the framework to address emerging threats, and member organizations must demonstrate progress through quarterly reporting to the Saudi Central Bank.
๐๏ธ Who Must Comply With the SAMA CSF?
The SAMA CSF applies to all entities regulated and supervised by SAMA โ collectively referred to as “Member Organizations.” The scope of applicability and the strictness of requirements varies slightly by entity type:
| Organization Type | Scope | Notes |
|---|---|---|
| Commercial Banks | Full framework | All domains fully applicable; highest maturity expectations; direct SAMA supervision |
| Insurance & Reinsurance Companies | Risk-based | Core domains apply; some subdomains adjusted for insurance-specific operations |
| Financing Companies & Money Changers | Risk-based | Cybersecurity and third-party domains emphasized; proportionate to scale |
| Credit Bureaus | Full framework | High sensitivity of credit data warrants full framework application |
| Financial Market Infrastructure | Full framework | Includes stock exchanges and clearing houses โ critical infrastructure classification |
| Fintech Firms & Digital Banks | Risk-based | SAMA requires compliance evidence pre-licensing; ongoing obligations post-licensing |
| Foreign Bank Branches in KSA | Subject to on-site inspection | Subject to SAMA oversight; parent-company frameworks must be mapped to CSF |
| IT/Service Providers to SAMA entities | Indirect via Third-Party domain | Not directly regulated, but SAMA entities must enforce CSF requirements contractually on vendors |
๐๏ธ The 4 Domains of the SAMA CSF
The SAMA CSF is organized around four core control domains. Each domain contains multiple subdomains, and every subdomain specifies a principle (why it exists), an objective (what must be achieved), and control considerations (how it should be implemented). Controls are numbered throughout and mapped to maturity levels.
Establishes the organizational foundation for all cybersecurity activities. Board-level accountability is central โ ultimate responsibility rests with the institution’s board.
Key subdomains:
Cybersecurity Strategy Cybersecurity Policy Governance Structure Roles & Responsibilities Project Management Cybersecurity AwarenessA cybersecurity committee chaired by a senior executive is required. The board must be briefed on cybersecurity posture and roadmap progress.
Aligns cybersecurity risk with enterprise risk management, and ensures regulatory obligations are systematically tracked and met.
Key subdomains:
Cyber Risk Assessment Risk Treatment Planning Regulatory Compliance Cybersecurity Metrics Business ContinuityOrganizations must define KPIs and KRIs for cybersecurity, conduct regular risk assessments, and integrate findings into the enterprise risk register.
The most extensive domain โ covering the day-to-day technical and operational security controls that protect systems, data, and services.
Key subdomains:
Asset Management Identity & Access Management Network Security Endpoint Security Vulnerability Management Event Monitoring & SIEM Incident Response Secure Development Data ProtectionEncryption, MFA, intrusion detection, security operations centers (SOCs), and penetration testing are all addressed within this domain.
Addresses cybersecurity risks introduced through the supply chain, outsourced services, and technology vendors โ a critical domain given the financial sector’s dependence on external providers.
Key subdomains:
Third-Party Risk Assessment Contractual Requirements Ongoing Monitoring Third-Party Access Management Vendor KPIs & KRIsSAMA holds primary institutions fully accountable for vendor cybersecurity failures. Binding contracts, audit rights, and regular reassessments are required for all critical suppliers.
๐ The 6 SAMA CSF Maturity Levels
Every control within the SAMA CSF is mapped to one of six maturity levels. The maturity level defines the sophistication and formalization of an organization’s implementation of each control. To progress to a higher level, all requirements of preceding levels must first be met โ there is no skipping levels. SAMA mandates a minimum of Level 3 for all member organizations, with some critical subdomains requiring Level 4.
No Awareness
No cybersecurity controls exist. No documentation, no awareness, no implementation of any security measures. This is the starting point for institutions with no prior cybersecurity program.
Ad-Hoc & Reactive
Some controls exist but are inconsistent, poorly defined, and applied informally. Security activities are reactive โ triggered by incidents rather than proactive risk management. No formal documentation or standardized approach exists.
Developing Consistency
Controls are implemented in a repeatable manner but lack formal documentation or standardization. Some processes are consistent across the organization, but there is no systematic approach to compliance verification or measurement. Policies may exist but are not consistently enforced.
Formal, Documented, and Consistently Enforced โ โ SAMA Minimum
Cybersecurity controls are formally documented, approved, communicated, and consistently implemented across the organization. Board-level visibility exists, KPIs are tracked, and compliance is enforced. All cybersecurity documentation clearly states “why, what, and how” controls are implemented. This is the baseline required by SAMA for all member organizations and the starting point for demonstrating regulatory compliance.
Measured and Continuously Improved
Controls are regularly assessed for effectiveness using defined Key Risk Indicators (KRIs) and performance metrics. Internal audits and compliance reviews are conducted routinely. Data from measurements drives continuous improvement. Some critical SAMA subdomains require Level 4 as their minimum. Real-time monitoring capabilities are expected at this level.
Adaptive and Enterprise-Integrated
Cybersecurity is fully integrated into enterprise risk management with continuous improvement driven by threat intelligence, automation, and peer benchmarking. Business process owners are accountable for monitoring control compliance. Automated real-time monitoring supports adaptive response. This is the highest maturity level and represents a proactive, resilient security posture โ compliance is embedded in the organization’s culture.
Where Does Your Organization Stand?
GHS conducts structured SAMA CSF gap assessments โ benchmarking every applicable control against the six maturity levels and producing a board-ready roadmap for SAMA submission.
Get a Free SAMA CSF Gap Assessment โ๐บ๏ธ The SAMA CSF Compliance Process: Step by Step
SAMA prescribes a structured compliance process. Organizations must not only implement controls โ they must submit roadmaps, provide quarterly progress reports, and pass internal audits. Here is the full sequence:
Conduct an In-Depth Current-State Assessment
Benchmark your current cybersecurity posture against every applicable SAMA CSF control and subdomain. This is a full evidence-based assessment โ not a self-declaration. Evidence includes policies, procedures, configuration screenshots, interview responses, audit logs, and system records. The goal is to establish the true maturity level for each control with supporting evidence.
Identify Gaps and Score Against the Maturity Model
Controls assessed below Level 3 are flagged as compliance gaps. Each gap is documented, risk-rated, and prioritized. This gap report forms the basis for your roadmap and is the deliverable SAMA expects to see your Board of Directors review and approve.
Develop a Compliance Roadmap and Obtain Board Approval
Based on the gap assessment, develop a detailed roadmap specifying how and when each gap will be closed, the resources required, and the responsible owners. SAMA requires this roadmap to be submitted to the Board of Directors for approval โ and the Board must provide explicit support for cybersecurity budget and team empowerment. The approved roadmap is then submitted directly to SAMA.
Implement Controls Across All Four Domains
Execute the roadmap โ deploying technical controls, establishing governance structures, documenting policies and procedures, conducting staff awareness training, and implementing third-party risk management processes. Implementation must produce auditable evidence at every step.
Submit Quarterly Progress Reports to SAMA
SAMA requires quarterly progress reports throughout the implementation period until full compliance is achieved. Reports must include quantitative progress metrics, evidence of controls implemented, and explanations for any deviations from the roadmap timeline. Transparency with SAMA during this phase is critical โ undisclosed delays or misrepresented progress are significant regulatory risks.
Internal Audit and Annual Compliance Reporting
SAMA requires an in-depth annual report from the institution’s Internal Audit Department showing the level of compliance against required maturity levels. This audit must be independent and evidence-based. The Board’s Cybersecurity Committee must actively follow up on compliance implementation and verify adherence to the approved roadmap.
Continuous Monitoring and Framework Maintenance
SAMA CSF compliance is not a one-time certification โ it requires continuous monitoring, periodic reassessment, and adaptation to evolving threats and SAMA updates. Organizations at Level 4 and 5 implement automated real-time monitoring and integrate cybersecurity data into enterprise risk dashboards. The Cybersecurity Committee reviews performance metrics and escalates issues to the Board regularly.
โ๏ธ SAMA CSF vs ISO 27001: Understanding the Difference
Saudi financial institutions frequently ask whether existing ISO 27001 certification satisfies SAMA CSF requirements โ or vice versa. The honest answer: they overlap significantly, but neither fully substitutes for the other.
| Dimension | SAMA CSF | ISO 27001 |
|---|---|---|
| Issuing body | Saudi Arabian Monetary Authority (SAMA) | International Organization for Standardization (ISO) |
| Geographic scope | Saudi Arabia only โ SAMA-regulated entities | Global โ any organization in any sector |
| Mandatory or voluntary | Mandatory โ enforced by SAMA with quarterly reporting | Voluntary โ international certification standard |
| Sector specificity | Built specifically for Saudi financial institutions; tailored to the Kingdom’s risk landscape | Sector-agnostic; broad applicability |
| Maturity model | 6-level maturity model (L0โL5); minimum L3 required | Conformance-based (comply or not); no maturity levels |
| Reporting requirements | Quarterly progress reports to SAMA; annual internal audit | Annual external certification audit; no regulatory reporting |
| Third-party domain | Explicit, prescriptive vendor risk requirements | Addressed in Annex A but less prescriptive |
| Control overlap | Very high โ ISO 27001 Annex A controls map significantly to SAMA CSF. Organizations with ISO 27001 certification typically start SAMA CSF at Level 2โ3 for many domains, not Level 0. | |
๐ Why SAMA CSF Compliance Is a Strategic Advantage
Institutions that treat SAMA CSF as a tick-box exercise miss its broader value. Organizations that invest in genuine compliance gain durable advantages:
- ๐ Regulatory standing and license continuity: Non-compliance risks license conditions, enhanced supervision, and reputational consequences. SAMA CSF compliance is a condition of operating in Saudi Arabia’s financial sector โ not an optional enhancement.
- ๐ Reduced cyber incident risk: The four domains collectively address the full attack surface of a financial institution. Organizations at Level 3+ show measurably lower rates of successful cyberattacks, data breaches, and ransomware incidents.
- ๐ Access to international partnerships: Foreign banks, correspondent banks, and international investors increasingly require evidence of cybersecurity maturity. SAMA CSF compliance is recognized internationally as a credible regulatory standard.
- ๐๏ธ Alignment with Vision 2030: Saudi Arabia’s national digitalization agenda requires a trusted, resilient financial infrastructure. SAMA CSF positions your institution as a responsible participant in that transformation.
- ๐ Multi-framework efficiency: SAMA CSF controls overlap significantly with PDPL, NCA ECC, ISO 27001, and PCI DSS. Compliance work done for SAMA CSF advances your readiness for other frameworks simultaneously โ reducing total compliance cost and effort.
๐ก๏ธ How GHS Helps Saudi Financial Institutions Achieve SAMA CSF Compliance
GHS provides end-to-end SAMA CSF compliance support for banks, insurance companies, financing firms, credit bureaus, and fintechs across Saudi Arabia. Our CISSP, CISM, and OSCP-certified team combines deep SAMA regulatory knowledge with practical cybersecurity implementation expertise.
SAMA CSF Gap Assessment & Maturity Scoring
We conduct a thorough, evidence-based assessment of your current cybersecurity posture against all four SAMA CSF domains and every applicable subdomain. Each control is scored against the six maturity levels with supporting evidence โ producing a precise, board-ready gap report that shows where you are, where you need to be, and the prioritized roadmap to get there.
Board-Ready Roadmap & SAMA Submission
We develop the formal compliance roadmap required by SAMA โ including milestone timelines, resource requirements, budget estimates, and risk justifications. We prepare it for Board of Directors presentation, obtain the necessary approvals, and manage the submission to SAMA. We also structure the roadmap to satisfy SAMA’s quarterly reporting requirements from day one.
Policy & Documentation Development
We develop every policy, procedure, standard, and governance document required by SAMA CSF โ from the organization-wide cybersecurity strategy and policy to subdomain-specific standards for identity management, incident response, third-party risk, and data classification. All documentation is structured to satisfy Level 3 “why, what, and how” requirements and positioned for Level 4 measurement integration.
Technical Controls Implementation
We deploy the technical controls SAMA CSF requires across Domain 3 โ including SIEM/SOC implementation, identity and access management, vulnerability management programs, network segmentation, encryption, endpoint protection, and secure development practices. We implement controls that produce auditable evidence โ not just theoretical security improvements.
Third-Party Risk Management Program
We build your complete Domain 4 compliance program โ third-party risk assessment methodologies, contractual cybersecurity clauses, vendor access management procedures, and ongoing monitoring frameworks. We help you enforce SAMA CSF requirements contractually on critical vendors and establish the KPI/KRI reporting structure SAMA expects for third-party oversight.
Cybersecurity Awareness Training
SAMA CSF requires organization-wide cybersecurity awareness โ documented, regular, and role-appropriate. GHS delivers targeted training programs for board members, senior management, IT and security teams, and general staff. Training is documented with completion records ready for SAMA audit inspection.
Internal Audit Support & Quarterly Reporting
We support your Internal Audit function in conducting the annual SAMA CSF compliance review โ preparing evidence portfolios, structuring audit methodologies, and producing the formal report SAMA requires. We also manage the quarterly progress reports to SAMA throughout your implementation journey, ensuring regulatory communications are accurate, timely, and strategically framed.
Ongoing Compliance Monitoring & Maintenance
SAMA CSF compliance is a continuous obligation. GHS provides ongoing monitoring services, periodic reassessments, control effectiveness reviews, and adaptation support as SAMA updates the framework or your organization’s risk profile changes. We keep you audit-ready โ not just momentarily compliant.
Related Compliance Guides
โ Frequently Asked Questions
The SAMA Cybersecurity Framework is not optional โ it is the foundational cybersecurity law for Saudi Arabia’s entire financial sector. With mandatory reporting, Board accountability requirements, and progressively enforced maturity standards, SAMA CSF compliance demands genuine, documented, and continuously maintained cybersecurity programs. Organizations that invest in real compliance don’t just satisfy the regulator: they build the cyber resilience that protects their customers, their reputation, and their operating license in one of the most targeted financial sectors in the Middle East.
Ready to Start Your SAMA CSF Compliance Journey?
GHS provides end-to-end SAMA CSF compliance support โ from the initial gap assessment and board roadmap through technical implementation, audit support, and continuous monitoring. Contact us for a free readiness consultation.
Talk to a GHS Expert โ
