Reach SAMA CSF maturity level 3 with evidence you can trust

The SAMA Cyber Security Framework (SAMA CSF) is a mandatory framework issued by the Saudi Central Bank in May 2017 to strengthen cyber resilience across the Saudi financial sector. It defines principles, objectives and control considerations in four domains: leadership and governance, risk management and compliance, operations and technology, and third-party cyber security. Organisations are measured against a maturity model from level 0 to level 5.

SAMA CSF applies to member organisations regulated by the Saudi Central Bank. This includes banks, insurance and reinsurance companies, finance companies, credit bureaus and financial market infrastructure operating in Saudi Arabia. Suppliers such as cloud, software and outsourcing providers are not directly regulated, but are often required by their financial services customers to meet SAMA CSF requirements through contracts and vendor assessments.

SAMA expects member organisations to reach at least maturity level 3 of the framework's six-level maturity model. At level 3, cyber security controls are defined, approved and implemented through documented policies, standards and procedures, and compliance with them is monitored. Levels 4 and 5 add measurement, periodic evaluation and continuous improvement, and organisations can aim higher where their risk profile justifies it.

SAMA CSF has four domains. Domain 3.1 covers cyber security leadership and governance. Domain 3.2 covers cyber security risk management and compliance. Domain 3.3 covers cyber security operations and technology, from access management to incident and vulnerability management. Domain 3.4 covers third-party cyber security, including contract and vendor management, outsourcing and cloud computing. Together they contain 32 subdomains.

SAMA CSF and ISO 27001 overlap heavily, and the framework drew on international standards such as ISO 27001 and the NIST Cybersecurity Framework. Topics like governance, risk management, access control, cryptography, incident management and supplier security appear in both. ISO 27001 certification does not replace SAMA CSF, but evidence and controls built for ISO 27001 can be reused for many SAMA CSF subdomains.

Compliance starts with a self-assessment of every SAMA CSF subdomain against the maturity model, followed by a plan to close gaps to at least level 3. That means documenting and approving policies, standards and procedures, implementing the controls, and monitoring compliance with them. Organisations then keep evidence current, as SAMA can review cyber security maturity and request supporting documentation.

Yes. Domain 3.4 of SAMA CSF covers third-party cyber security through three subdomains: contract and vendor management, outsourcing, and cloud computing. Member organisations must define security requirements before contracts are signed, assess vendor risk and monitor compliance over the contract life-cycle. Outsourcing and cloud arrangements are also subject to SAMA's separate rules and approval requirements.

SAMA CSF is mapped in OneClickComply's control library and is available on request. Once enabled, its subdomains link to the same controls, policies, risks and automatically collected evidence you use for other frameworks, so work done for standards such as ISO 27001 counts towards SAMA CSF. Our in-house audit team can also answer questions through Ask an Auditor.