SAMA CSF | SAMA CYBER SECURITY FRAMEWORK

SAMA CSF Compliance in Saudi Arabia

SecureLink works with SAMA-regulated financial institutions on gap assessments, control reviews, remediation planning, evidence preparation, and ongoing reviews under the SAMA Cyber Security Framework. We first confirm what applies to the organization, then work with the team to turn the requirements into clear actions, assigned responsibilities, supporting evidence, and straightforward reporting.

Request a SAMA CSF Gap Assessment Explore SAMA CSF Services

SAMA CSF compliance services in Saudi Arabia

SAMA Cyber Security Framework readiness and evidence review

SAMA CSF • SAMA CYBER SECURITY FRAMEWORK

Put a clear cybersecurity programme in place

The SAMA Cyber Security Framework gives financial institutions regulated by the Saudi Central Bank a risk-based way to manage cybersecurity. It covers governance, maturity, and the protection of information assets and online services.

SecureLink helps teams put those requirements into practice. That may start with a scope and gap assessment, then move into control implementation, evidence preparation, remediation, and readiness reviews as needed.

SAMA owns the framework and is responsible for its official interpretation. SecureLink provides consulting and readiness support around the requirements that apply to each organization.

/// SAMA CYBERSECURITY READINESS

Why the SAMA Framework
matters to financial institutions

SAMA describes the framework as a way for regulated financial institutions to identify and address cybersecurity risks, improve their maturity, and protect information assets and online services. It also places responsibility for cybersecurity oversight with senior management and the board.

DISCUSS YOUR SAMA CSF REQUIREMENTS

Saudi Central Bank and SAMA Cyber Security Framework

Risk-Based Framework Governance • Controls • Maturity

SAMA FRAMEWORK STRUCTURE

Four domains shape the cybersecurity programme

The framework is organized into four main domains. Each one is divided into subdomains with principles, objectives, and numbered control considerations.

Cyber Security Leadership and Governance

Set clear leadership responsibilities, policies, and oversight so cybersecurity stays connected to business needs and regulatory expectations.

Cyber Security Risk Management and Compliance

Identify cybersecurity risks, understand where the organization stands, decide how risks should be treated, and keep track of the controls protecting important information assets.

Cyber Security Operations and Technology

Cover the technical and operational safeguards used to protect systems, applications, networks, information, online services, and day-to-day security operations.

Third Party Cyber Security

Manage cybersecurity expectations and third-party risk across suppliers and other external relationships that could affect the organization.

How the framework is organized

Each subdomain is set out through a principle, an objective, and control considerations. The framework follows a risk-based approach, with numbered control considerations and, where applicable, different levels within them.

APPLICABILITY

Confirm the right scope before you assess

The SAMA framework applies to Member Organizations regulated by SAMA. Before controls or evidence are mapped, the organization should confirm its regulatory status and the requirements that apply to its activities.

01 • Banking

Banks operating in Saudi Arabia

Banks operating in the Kingdom are included in the framework's stated applicability.

02 • Insurance

Insurance and reinsurance companies

Insurance and reinsurance companies are included within the stated SAMA Member Organization scope.

03 • Financing

Financing companies

Financing companies regulated by SAMA are included in the framework's applicability section.

04 • Credit

Credit bureaus

Credit bureaus operating in Saudi Arabia are identified as Member Organizations covered by the framework.

05 • Infrastructure

Financial market infrastructure

Financial Market Infrastructure is also identified within the Member Organization scope.

06 • Context

Other SAMA-supervised environments

The Rulebook also refers to payment systems, payment service providers, and regulatory sandbox contexts. The exact requirements should be checked for the organization and activity involved.

Scope matters: SAMA's framework includes sector-specific conditions and exceptions for some subdomains. It is therefore important to confirm which requirements apply instead of assuming that every control is the same for every financial institution.

MATURITY AND ASSURANCE

See where your controls, maturity and evidence stand

The framework uses periodic self-assessment and a six-level cybersecurity maturity model. SecureLink can help teams understand their current position, organize evidence, and turn the findings into a workable improvement plan.

LEVEL 0

Non-existent

The relevant control is not documented or there is little evidence that it is understood or in place.

LEVEL 1

Initial maturity

Some controls may exist, but they are still early-stage or inconsistent and need clearer definition and repeatable operation.

LEVEL 2

Developing maturity

Practices are more established, but stronger consistency, ownership, and evidence are still needed.

LEVEL 3

Defined maturity

Control practices are defined and implemented, with clearer governance and day-to-day operating expectations.

LEVEL 4

Managed maturity

Controls are measured and managed with stronger oversight, repeatable processes, and better visibility into performance.

LEVEL 5

Optimized maturity

Cybersecurity practices are improved over time using measurement, lessons learned, and regular review.

Important: the framework has six maturity levels, but the target level and implementation obligations can depend on the relevant SAMA instructions and the type of Member Organization. SecureLink can help assess the current state and map out the next steps that apply.

SAMA CYBERSECURITY SERVICES

SAMA CSF Compliance Services

SecureLink tailors each engagement to the requirements that apply, linking findings to evidence, responsible owners, risk, remediation actions, and readiness needs.

SAMA Applicability and Scope Review

We first confirm the requirements, organizational scope, systems, stakeholders, and evidence that should be reviewed before the detailed assessment starts.

SAMA Cybersecurity Gap Assessment

We compare the current cybersecurity posture with the applicable SAMA requirements and document gaps, observations, owners, and priorities in a clear assessment matrix.

Governance and Policy Review

We review governance structures, cybersecurity policies, responsibilities, committees, and operating procedures against the SAMA expectations that apply.

SAMA Cybersecurity Controls Assessment

We review the relevant SAMA cybersecurity controls, technical safeguards, configurations, operational practices, and supporting evidence with the people responsible for those controls.

Remediation and Implementation Support

We turn agreed findings into practical actions covering governance, processes, technical safeguards, documentation, evidence, and validation.

SAMA Audit Readiness and Evidence Review

We check that evidence is current, traceable, complete, and clearly connected to the controls and activities it is meant to support.

Self-Assessment and Reporting Support

We help control owners organize assessment responses, evidence status, open actions, and management reporting so progress is easy to follow.

Ongoing Compliance Improvement

We keep track of remediation, control changes, evidence updates, and maturity improvements so readiness is maintained over time rather than treated as a one-off task.

SAMA CYBERSECURITY IMPLEMENTATION

From findings to
practical remediation

Good implementation is easier to manage when every important finding has an owner, a corrective action, supporting evidence, and a clear point for validation. SecureLink helps teams turn SAMA requirements into work they can track, review, and report on.

The work usually includes:

Baseline assessment and control mapping

Governance, policy and procedure improvement

Technical and administrative control implementation

Evidence organization and reporting

The goal is not paperwork for its own sake. Your team should be able to see what is in place, what evidence supports it, what is still open, and where management decisions are needed.

SAMA audit readiness and compliance review

WHY CHOOSE US

Why Choose SecureLink for SAMA Readiness

Our work focuses on the link between the SAMA requirements and what your team can actually show: scope, control ownership, remediation, documentation, assessment preparation, and ongoing improvement.

Scope Before Controls

We confirm what applies first, so the assessment starts with the right scope and the right evidence.

Control-to-Evidence Mapping

We connect the requirements to the policies, processes, configurations, records, and other evidence your team uses to demonstrate them.

Risk-Prioritized Remediation

Findings are turned into actions with clear owners, priorities, target dates, and points for validation.

Management Visibility

Reporting gives management a clear view of open gaps, evidence status, implementation progress, and decisions that need attention.

Readiness for Periodic Review

We help teams keep controls, evidence, and corrective actions organized for recurring self-assessment and review.

Continuous Improvement

Compliance is managed as an ongoing programme, with changes, remediation, and evidence updates tracked over time.

WORK PROCESS

Our SAMA Cybersecurity Compliance Process

The process is straightforward: understand the current state, address the gaps, organize the evidence, and keep the organization ready for review.

Scope & Gap
Assessment

Confirm what applies, review the current cybersecurity posture, identify gaps, and set a clear starting point.

Governance &
Implementation

Update governance, policies, procedures, and applicable cybersecurity controls based on the agreed remediation plan.

Evidence &
Readiness Review

Map evidence to the requirements, confirm implementation status, close documentation gaps, and prepare the assessment materials.

Review & Continuous
Improvement

Support periodic review, management reporting, corrective actions, and continued improvement of cybersecurity maturity.

OFFICIAL REFERENCES

Use the SAMA source documents as the starting point

The current SAMA materials should remain the main reference for applicability, framework structure, maturity, controls, and interpretation.

SAMA Cyber Security Framework

The SAMA Rulebook page provides the framework status, scope, applicability, responsibilities, structure, and maturity model.

View SAMA Rulebook →

Original SAMA Framework PDF

The published framework document provides the detailed principles, objectives, control considerations, and requirements.

Open SAMA Framework PDF →

----» BUILD A STRONGER SAMA READINESS PROGRAMME

Prepare for SAMA CSF Compliance
with clear evidence and next steps

Whether you need a SAMA gap assessment, help with control implementation, evidence review, or ongoing readiness support, SecureLink can help your team understand what applies and decide what needs to happen next.

Clearer
Scope

Stronger
Evidence

Practical
Remediation

Ongoing
Readiness

Request a SAMA CSF Readiness Consultation

Cybersecurity infrastructure supporting SAMA readiness

FAQS

Frequently Asked Questions

Here are some common questions about the SAMA Cyber Security Framework, who it applies to, assessments, and readiness work.

What is the SAMA Cyber Security Framework?

The SAMA Cyber Security Framework is used by financial institutions regulated by the Saudi Central Bank. It sets out principles, objectives, and control considerations and supports periodic maturity assessment.

Which organizations are covered by the SAMA framework?

The SAMA Rulebook includes banks, insurance and reinsurance companies, financing companies, credit bureaus, and financial market infrastructure within its stated applicability. The exact scope should still be confirmed for the organization and its activities.

What are the four SAMA cybersecurity domains?

The four domains are Cyber Security Leadership and Governance, Cyber Security Risk Management and Compliance, Cyber Security Operations and Technology, and Third Party Cyber Security.

How is SAMA cybersecurity maturity assessed?

SAMA's framework uses a six-level cybersecurity maturity model, from Level 0 to Level 5. Organizations use self-assessment and periodic review, while the applicable target and obligations depend on the relevant SAMA instructions and the type of Member Organization.

What does a SAMA cybersecurity gap assessment include?

A gap assessment compares the organization's current cybersecurity posture with the SAMA requirements that apply, identifies control and evidence gaps, and sets out remediation actions, owners, priorities, and next steps.

Can SecureLink help with SAMA implementation and remediation?

Yes. SecureLink can help with governance and policy work, control implementation, evidence preparation, remediation planning, readiness reviews, and ongoing improvement.

Does SecureLink provide the official SAMA regulatory approval?

No. SecureLink provides consulting and readiness support. SAMA remains the framework owner and is responsible for official interpretation and regulatory oversight.

How long does SAMA cybersecurity compliance take?

The timeline varies with the organization's size, current maturity, applicable requirements, available evidence, remediation scope, and management decisions. A gap assessment can help establish a realistic implementation plan.

How does SAMA audit readiness work?

SAMA audit readiness means confirming what applies, checking that controls are implemented, organizing traceable evidence, documenting open actions, and preparing management reporting for periodic review and audit activities.