The SAMA Cybersecurity Framework (SAMA CSF) is the mandatory cybersecurity standard for organisations regulated by the Saudi Central Bank, still widely known as SAMA. First issued in 2017, it defines the controls that banks, insurers, financing companies and other member organisations must implement and the maturity level they must demonstrate through self-assessment and SAMA review. This guide explains who must comply, how the framework is structured, what maturity level 3 requires, how it relates to the NCA Essential Cybersecurity Controls and how to run a compliance programme that holds up to review.
Key Takeaways
- SAMA CSF applies to all SAMA member organisations: banks, insurance and reinsurance companies, financing companies, credit bureaus and financial market infrastructure, plus their subsidiaries and relevant third parties.
- The framework has four main domains: leadership and governance, risk management and compliance, operations and technology, and third-party cyber security.
- Compliance is measured on a 0 to 5 maturity model, and member organisations are expected to reach at least maturity level 3 for each control.
- Organisations submit periodic self-assessments and are subject to SAMA review and audit; evidence quality decides the outcome.
- Most SAMA entities also fall under NCA ECC and often PCI DSS, so one integrated control framework is the efficient route.
Who Must Comply With the SAMA Cybersecurity Framework?
The framework applies to every organisation that SAMA regulates as a member organisation. In practice that means all banks operating in the Kingdom including branches of foreign banks, insurance and reinsurance companies, finance and leasing companies, credit bureaus, payment and fintech companies licensed by SAMA, and financial market infrastructure. The obligations extend to subsidiaries and to outsourcing partners that handle member organisation data or systems, which is why third-party security is a domain of its own.
UAE-headquartered groups with Saudi banking or insurance subsidiaries must comply locally in addition to CBUAE requirements at home. Our guide to CBUAE cybersecurity requirements shows how the two regimes compare.
How the Framework Is Structured
SAMA CSF is organised into four main domains, each broken into subdomains with specific control considerations.
1. Cyber Security Leadership and Governance. Governance structure, a board-approved strategy, policy framework, defined roles including a cybersecurity function independent of IT, awareness programmes and the human-resources controls around joiners, movers and leavers.
2. Cyber Security Risk Management and Compliance. A risk management process integrated with enterprise risk, regular risk assessments, compliance with laws and regulations, cyber security review by internal audit and a programme of independent audits.
3. Cyber Security Operations and Technology. The technical core: asset management, architecture, identity and access management, application and infrastructure security, cryptography, secure development, change and patch management, threat management, vulnerability management, security event monitoring, incident management, business continuity and electronic banking and payment security.
4. Third Party Cyber Security. Contractual requirements, due diligence, outsourcing controls and cloud computing requirements for suppliers and partners.
Each subdomain states an objective and the control considerations an organisation must implement and evidence. The structure maps cleanly to ISO 27001, which is why many Saudi institutions run the two together; our ISO 27001 certification guide describes the ISMS foundation.
The SAMA Maturity Model and Level 3
SAMA measures compliance using a six-level maturity model from 0 to 5:
- Level 0, Non-existent: no documentation or control in place.
- Level 1, Ad hoc: controls exist but are partial, inconsistent and undocumented.
- Level 2, Repeatable but informal: controls are executed consistently but not formally defined or approved.
- Level 3, Structured and formalised: controls are defined, approved, implemented and monitored, with evidence.
- Level 4, Managed and measurable: effectiveness is measured with KPIs and periodically evaluated.
- Level 5, Adaptive: controls are continuously improved based on measurement and threat changes.
Member organisations are expected to achieve at least level 3 for each control. Reaching level 3 means a control is documented in approved policy and procedure, implemented across the in-scope environment, monitored for compliance and supported by evidence such as logs, records and review minutes. A control that works in practice but has no approved standard behind it scores level 2 and fails the target.
Self-Assessment, SAMA Review and Audit
Compliance is demonstrated through a periodic self-assessment in which the organisation rates each control’s maturity and attaches evidence, reviewed and signed off by senior management. SAMA reviews submissions, may request evidence and conducts on-site reviews and audits. Findings must be remediated through tracked action plans, and repeat shortfalls attract supervisory attention. The practical lesson from every SAMA review is the same: the evidence library matters as much as the control. Build it continuously rather than before the deadline.
SAMA CSF and NCA ECC: Complying With Both
The National Cybersecurity Authority’s Essential Cybersecurity Controls apply to government entities and to organisations in critical national infrastructure, and many SAMA-regulated institutions fall under both. The two frameworks overlap substantially on governance, asset management, identity, logging, incident response and third-party security, but their structures, maturity expectations and reporting cycles differ. The efficient approach is a single integrated control set mapped to SAMA CSF, NCA ECC and ISO 27001, with one evidence library serving every assessment. Our NCA ECC compliance guide explains the second framework in detail.
A Practical SAMA Compliance Roadmap
- Scope and govern: appoint an accountable cybersecurity head independent of IT, secure board approval of the strategy and establish a steering committee.
- Assess: run a gap assessment against every subdomain with maturity scoring and an evidence inventory.
- Remediate the governance layer first: policies, standards, risk methodology and the compliance calendar, because without them no control can exceed level 2.
- Fix the technical priorities: privileged access management, MFA, security monitoring, vulnerability management and secure configuration are the most common level-3 failures. Our guides to privileged access management and managed SOC options cover two of them.
- Address third parties: contract clauses, due diligence and cloud requirements for every supplier in scope.
- Test: penetration testing, red teaming and incident response exercises aligned to SAMA expectations.
- Evidence and self-assess: maintain the evidence library, run an internal pre-assessment and submit with management sign-off.
- Sustain: quarterly control testing and annual reassessment to hold level 3 and progress towards level 4.
Frequently Asked Questions
What is the SAMA Cybersecurity Framework?
It is the mandatory cybersecurity standard issued by the Saudi Central Bank (SAMA) for the organisations it regulates. It defines control objectives across governance, risk, operations and third-party security and requires member organisations to demonstrate a defined maturity level through self-assessment and SAMA review.
Who must comply with SAMA CSF?
All SAMA member organisations, including banks, insurance and reinsurance companies, financing companies, credit bureaus, SAMA-licensed payment and fintech companies and financial market infrastructure, together with their subsidiaries and relevant outsourcing partners.
What maturity level does SAMA require?
Member organisations are expected to achieve at least maturity level 3, structured and formalised, for each control. That means the control is documented in approved policy, implemented, monitored and supported by evidence.
How often is a SAMA self-assessment required?
Self-assessments are submitted periodically as directed by SAMA, typically annually, and SAMA may conduct on-site reviews and audits at any time. Confirm the current cycle with your SAMA relationship team.
Is SAMA CSF the same as NCA ECC?
No. SAMA CSF is issued by the Saudi Central Bank for financial institutions; NCA ECC is issued by the National Cybersecurity Authority for government and critical infrastructure organisations. Many financial institutions must comply with both, and the controls overlap substantially.
Does ISO 27001 certification satisfy SAMA CSF?
No, but it helps. ISO 27001 provides the management system and many overlapping controls, while SAMA CSF adds specific requirements such as banking-specific technology controls, maturity scoring and SAMA reporting. Most institutions run them as one integrated programme.
Talk to a UAE Cybersecurity Team
Cybersecurity MEA supports Saudi and GCC financial institutions with SAMA CSF gap assessments, remediation and evidence programmes through our regulatory compliance consulting and GRC services, backed by red teaming and a 24/7 SOC. Explore our work with banking and finance clients or request a SAMA readiness assessment.