SAMA Cybersecurity Framework: A Practical Overview for Saudi Financial Institutions

The Saudi Central Bank (SAMA) Cybersecurity Framework sets the cybersecurity expectations for organizations SAMA regulates. Issued in 2017, it is one of the most structured frameworks in the region, and it is the reference point SAMA uses when it assesses how well a financial institution manages cyber risk.

Who it applies to

The framework applies to SAMA's member organizations: banks, insurance and reinsurance companies, finance companies, credit bureaus, and financial market infrastructure operating in Saudi Arabia. Fintechs licensed or operating in SAMA's regulatory sandbox should also expect to be measured against it as they grow.

The four domains

• Cyber Security Leadership and Governance — strategy, policies, roles, board oversight, and awareness
• Cyber Security Risk Management and Compliance — risk assessment, regulatory compliance, and audit
• Cyber Security Operations and Technology — the day-to-day controls: identity and access, network and application security, monitoring, incident handling, vulnerability management, and more
• Third Party Cyber Security — outsourcing, cloud, and vendor risk

The maturity model

Rather than a pass/fail checklist, SAMA uses a maturity model from level 0 (non-existent) to level 5 (adaptive). Member organizations are expected to reach at least level 3 — 'structured and formalized' — meaning controls are defined, documented, approved, and consistently implemented, not just present in practice. Many organizations discover that controls they genuinely operate still fall short because they are not formally documented or measured.

How institutions typically approach it

• Run a maturity assessment against every domain and sub-domain, with evidence, not just interviews
• Prioritize gaps by regulatory exposure and actual risk
• Formalize policies, procedures, and standards so working controls reach level 3
• Strengthen monitoring and incident response — areas SAMA reviews closely
• Bring third parties and cloud providers into scope with contracts, assessments, and ongoing oversight
• Track progress with metrics the board and regulator can understand

How SAMA fits with NCA and PDPL

SAMA-regulated institutions also sit under the NCA's Essential Cybersecurity Controls and, for personal data, the SDAIA Personal Data Protection Law. Mapping these together avoids duplicated work: most controls satisfy more than one requirement if they are designed and evidenced with all three in mind.

CYVOXAI supports banks, insurers, and fintechs with SAMA maturity assessments, remediation roadmaps, and the documentation needed to demonstrate level 3 and above. Get in touch to discuss your current position.