Bahrain, Saudi Arabia
SAMA Cyber Security Framework Compliance
Reach and prove the cyber security maturity SAMA expects of the organisations it regulates, with a team based in Dammam: maturity assessment, remediation and support for SAMA’s periodic self-assessments.
The SAMA CSF at a glance
- 2017
- issued by SAMA circular on 24 May 2017, and still in force
- 4
- main domains, from leadership and governance to third parties
- Level 3
- the minimum maturity level Member Organizations should operate at
- 0–5
- maturity levels used to measure each control
Who the framework applies to
Banks
All banks operating in Saudi Arabia. Every domain of the framework applies to the banking sector.
Insurance and reinsurance
All insurance and reinsurance companies operating in Saudi Arabia.
Financing companies
All financing companies operating in Saudi Arabia.
Credit bureaus
All credit bureaus operating in Saudi Arabia.
Financial market infrastructure
The financial market infrastructure regulated by SAMA.
Where the subdomains sit
Operations and technology carries the most work: more than half of the framework’s subdomains.
| Item | Subdomains |
|---|---|
| Leadership and Governance | 7 |
| Risk Management and Compliance | 5 |
| Operations and Technology | 17 |
| Third Party Cyber Security | 3 |
The four domains
Each domain groups subdomains of related controls. We assess and implement all of them.
Cyber Security Leadership and Governance
Strategy, policy, roles and responsibilities, the cyber security function and governance, awareness and training.
Cyber Security Risk Management and Compliance
Cyber security risk management, regulatory compliance, compliance with national and international standards, and cyber security review and audit.
Cyber Security Operations and Technology
Asset, identity and access management, application, change and infrastructure security, cryptography, mobile and customer protection, monitoring, incident and threat management.
Third Party Cyber Security
Contract and vendor management, outsourcing and cloud computing.
The maturity model
SAMA measures each control on a scale from 0 to 5. Member Organizations should operate at level 3 or higher.
| Topic | Level name | Against the minimum |
|---|---|---|
| Level 0 | Level name: Non-existent | Against the minimum: Below the minimum |
| Level 1 | Level name: Ad-hoc | Against the minimum: Below the minimum |
| Level 2 | Level name: Repeatable but informal | Against the minimum: Below the minimum |
| Level 3 | Level name: Structured and formalized | Against the minimum: The minimum SAMA expects |
| Level 4 | Level name: Managed and measurable | Against the minimum: Above the minimum |
| Level 5 | Level name: Adaptive | Against the minimum: Above the minimum |
Member Organizations are subject to periodic self-assessments, which SAMA reviews and audits to determine their level of compliance.
How we take you to compliance
- 01
Scope
We confirm which domains and subdomains apply to your sector and services.
- 02
Maturity assessment
We rate your current maturity for every applicable control.
- 03
Remediation roadmap
We prioritise the gaps that keep you below level 3 by risk and effort.
- 04
Implementation
Policies, procedures and technical controls, from governance to third parties.
- 05
Self-assessment support
Evidence and answers ready for SAMA’s periodic self-assessment and its review.
Related SAMA frameworks
Cyber Resilience Fundamental Requirements (2022)
Requirements for finance, payment and money exchange companies, aligned with the CSF and not a replacement for it.
IT Governance Framework (2021)
Implemented together with SAMA’s cyber security and business continuity frameworks.
Counter-Fraud Framework (2022)
Implemented together with other SAMA frameworks, including the CSF.
Business Continuity Management Framework
Business continuity requirements that the CSF refers to.
It is the cyber security framework the Saudi Central Bank (SAMA) issued by circular on 24 May 2017 for the organisations it regulates. It has four main domains and uses a maturity model from level 0 to level 5.
All Member Organizations regulated by SAMA: banks, insurance and reinsurance companies, financing companies and credit bureaus operating in Saudi Arabia, and the financial market infrastructure. All domains apply to banks; for other sectors, a few subdomains apply only in certain cases.
Member Organizations should operate at maturity level 3, “structured and formalized”, or higher.
Member Organizations complete periodic self-assessments using a questionnaire. SAMA reviews and audits these self-assessments to determine their level of compliance.
No. The CSF is issued by SAMA for the financial sector, and the Essential Cybersecurity Controls are issued by the National Cybersecurity Authority. SAMA has also required financial institutions to comply with the NCA’s Data Cybersecurity Controls (DCC-1:2022). We help with both frameworks.
VirtuThinko Company works with organisations across the Kingdom from our office in Dammam.
Talk to our team in Saudi Arabia
Tell us where you stand against the SAMA Cyber Security Framework and we will plan the path to level 3 and beyond.