Saudi Arabia

SAMA Cyber Security Framework

The Saudi Central Bank’s Cyber Security Framework binds every institution SAMA regulates: banks, insurers, finance companies, payment service providers and their outsourced operations. It organises cybersecurity into four domains, leadership and governance, risk management and compliance, operations and technology, and third parties, and measures each control on a maturity scale from 0 to 5, with level 3 the expected baseline. Institutions self-assess annually and SAMA reviews the result.

The framework asks for maturity that is defined, implemented and measured. DECIMA supplies the measurement, every day.

At a glance

Issued by

Saudi Central Bank (SAMA)

Applies to

All SAMA-regulated financial institutions: banks, insurers, finance companies, payment service providers and their outsourced operations

In force

Since 2017, with updates issued by SAMA; assessed annually

Supervised by

SAMA, through the annual self-assessment and its own reviews

What the mandate requires

The obligations as the regulation states them, in the order a programme meets them.

1. 01

   Cybersecurity leadership and governance

   A board-endorsed cybersecurity strategy, policy and organisation, with defined roles, a cybersecurity committee and awareness and training programmes.

2. 02

   Risk management and compliance

   A cybersecurity risk management process integrated with enterprise risk, compliance with the framework tracked and reported, and regular internal and external audits.

3. 03

   Operations and technology

   Controls over asset management, identity and access, application and infrastructure security, cryptography, secure development, vulnerability and patch management, event monitoring and incident management.

4. 04

   Third-party cybersecurity

   Cybersecurity requirements in contracts, due diligence and ongoing monitoring of outsourced providers and cloud services.

How DECIMA evidences it

Each requirement is answered from live systems with a dated, re-verifiable record, not from a questionnaire completed for the assessment.

• Maturity measured, not asserted

  Each control’s maturity is derived from dated reads of the systems that operate it, so the level reported to SAMA is the level observed across the period.

• Operations controls read continuously

  Access, patching, logging, vulnerability and configuration controls are read on a schedule, each read stored with its timestamp and the framework version applied.

• Self-assessment produced from the record

  The annual self-assessment is generated from a year of dated evidence, control by control, rather than completed from memory in the weeks before submission.

• Third-party evidence attached

  Provider assessments, contract clauses and monitoring results are held as structured records linked to the controls they satisfy.

04

Questions buyers ask

Short answers you can quote.