SAMA CSF

The SAMA Cyber Security Framework is the mandatory cybersecurity standard for institutions supervised by the Saudi Central Bank (still widely referred to as SAMA, the Saudi Arabian Monetary Authority). Version 1.0 was issued in May 2017 and applies to banks, insurance and reinsurance companies, financing companies, credit bureaus, and financial market infrastructure.

It is principle-based and organized into four domains (cyber security leadership and governance, risk management and compliance, operations and technology, and third-party cyber security) with 32 subdomains, each stating a principle, an objective, and control considerations.

Every member organization is measured on a six-level maturity model (0 non-existent to 5 adaptive) and must operate at level 3 (structured and formalized, with documented, approved, and implemented controls) or higher across the framework.

Compliance is assessed through a self-assessment questionnaire that SAMA reviews and audits, supplemented by SAMA on-site reviews and by independent assessments the regulator may require.

In writing, a member organization needs a board-approved cyber security strategy, policy, and governance charter with a dedicated cyber security function and committee, a risk management methodology and register, a compliance register mapping SAMA and other requirements, documented controls for each subdomain (identity and access, infrastructure, applications, cryptography, secure development, monitoring, incident management, business continuity), third-party contracts and assessments, awareness records, and the annual maturity self-assessment with evidence.

SAMA has issued additional frameworks (business continuity, IT governance) and the NCA's ECC also applies to the sector.