Quick answer: The SAMA Cyber Security Framework is the cyber security standard issued by the Saudi Central Bank (formerly the Saudi Arabian Monetary Authority) for regulated financial institutions in Saudi Arabia. It is organized into four domains: leadership and governance, risk management and compliance, operations and technology, and third-party security. Organizations measure themselves against a maturity model, with level 3 generally expected as the minimum.
The framework was introduced so that banks, insurers and other financial firms in the Kingdom manage cyber risk consistently. This guide explains its structure, the maturity levels and practical steps to comply. Insurance supervision in Saudi Arabia has since moved to the Insurance Authority, so insurers should confirm which requirements now apply to them.
Framework structure
| Domain | Main topics |
|---|---|
| Cyber security leadership and governance | Strategy, committee, policies, roles, awareness and training |
| Cyber security risk management and compliance | Risk assessments, regulatory compliance, audit |
| Cyber security operations and technology | Asset management, access control, network and application security, monitoring, incident response |
| Third-party cyber security | Contracts, outsourcing, cloud services |
The domains cover governance as well as technology. Regulators expect evidence that the board and senior management direct cyber security, not just that tools are installed.
Maturity levels
The framework uses a maturity model from level 0 (non-existent) to level 5 (adaptive). At level 3, controls are defined, documented, approved and implemented consistently, which is generally the expected minimum for regulated institutions. Higher levels add measurement and continuous improvement.
Who it applies to
The framework covers organizations regulated by the Saudi Central Bank, including banks, finance companies, credit bureaus and financial market infrastructure. It originally also covered insurance companies. Official texts are published in the SAMA rulebook.
How to comply
- Map your current controls to each domain and sub-domain.
- Rate your maturity honestly and identify gaps using a gap analysis.
- Prioritize governance items such as approved policies and a cyber security committee.
- Track remediation in a plan with owners and dates, similar to a POA&M.
- Collect evidence for each control ahead of regulatory reviews.
- Review third-party and cloud contracts for required security clauses; see our guide to the MSA in cyber security.
Related frameworks
Saudi organizations may also need to follow the National Cybersecurity Authority’s Essential Cybersecurity Controls. Our comparisons of NIST CSF vs ISO 27001 and broader compliance frameworks help multinational firms align requirements.
Frequently asked questions
What is the SAMA Cyber Security Framework?
It is the cyber security standard issued by the Saudi Central Bank for regulated financial institutions in Saudi Arabia.
What maturity level does SAMA require?
Level 3, where controls are defined and consistently implemented, is generally expected as a minimum for regulated institutions.
Does the SAMA framework apply to insurance companies?
It originally did. Insurance supervision has since moved to the Saudi Insurance Authority, so insurers should check its current cyber requirements.
Is the SAMA framework based on international standards?
It aligns with widely used standards such as ISO 27001 and the NIST Cybersecurity Framework, adapted to the Saudi financial sector.
Conclusion
The SAMA framework expects cyber security to be governed, risk-based and proven with evidence. Assess your maturity in each domain, close gaps in order of risk and keep documentation ready. Confirm with your regulator which version and requirements apply to your organization.
