SAMA Cyber Security Framework compliance software
Rate all 32 subdomains of the SAMA Cyber Security Framework on its six-level maturity model, see every subdomain below level 3 as a finding, and reuse NCA ECC evidence through a crosswalk a person confirms.
- IssuerSaudi Central Bank (SAMA)
- Version1.0, May 2017 (circular 381000091275), in force
- Structure4 domains and 32 subdomains
- Maturity modelSix levels, from 0 Non-existent to 5 Adaptive
- Expected minimumMaturity level 3 or higher
- AssessmentSelf-assessment, reviewed and audited by SAMA
What SAMA CSF requires
Who it applies to
- Banks operating in Saudi Arabia, to which every domain applies
- Financing companies and credit bureaus operating in Saudi Arabia
- The financial market infrastructure
- Insurance and reinsurance companies named in the Framework, now supervised by the Insurance Authority
- Service providers asked by a SAMA-regulated client to evidence the Framework's third-party, outsourcing and cloud controls
The Cyber Security Framework is issued by the Saudi Central Bank (SAMA) for the financial institutions it regulates, which the Framework calls Member Organizations, and SAMA states that they must adopt it. Version 1.0, dated May 2017 (circular 381000091275), is the version in force in SAMA's Rulebook. It applies to all banks, insurance and reinsurance companies, financing companies and credit bureaus operating in Saudi Arabia and to the financial market infrastructure; every domain applies to banks, with named exceptions for the others. Insurance supervision has since passed to the Insurance Authority, which began operating in November 2023, so insurers should confirm which cyber requirements their regulator now applies.
The Framework is principle based. It has four domains (Cyber Security Leadership and Governance, Cyber Security Risk Management and Compliance, Cyber Security Operations and Technology, and Third Party Cyber Security) divided into 32 subdomains, and each subdomain states a principle, an objective and control considerations. Where a control consideration cannot be implemented, the Member Organization considers compensating controls, an internal risk acceptance and a formal waiver request to SAMA. Implementation is self-assessed against a questionnaire, and SAMA reviews and audits the self-assessments to determine compliance and maturity.
Maturity is measured on six levels: 0 Non-existent, 1 Ad-hoc, 2 Repeatable but informal, 3 Structured and formalized, 4 Managed and measurable, and 5 Adaptive. To achieve level 3, 4 or 5 a Member Organization must first meet every criterion of the levels below, and SAMA states that Member Organizations should at least operate at maturity level 3: controls defined, approved and implemented in a structured way, policies, standards and procedures established, compliance with them monitored, and key performance indicators reported.
Related reading: NCA Essential Cybersecurity Controls; One supplier assurance programme for APRA CPS 230, MAS, HKMA, SAMA and the CBUAE
How GRCLens supports SAMA CSF
SAMA CSF runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
All 32 subdomains on SAMA's scale
Each subdomain is rated from level 0 to level 5 or marked not applicable, with the Framework's exceptions for non-bank Member Organizations applied by entity type, so a financing company is not asked a subdomain the Framework excludes for it.
The weakest subdomain leads
An average would hide the subdomain an examiner asks about first, so the headline is the lowest applicable subdomain level, beside the number of subdomains at level 3 or above. Each domain takes its lowest subdomain, and the mean appears as a trend only.
Every subdomain below level 3 is a finding
Subdomains below SAMA's expected minimum are listed largest gap first, each with an owner, effectiveness testing, review dates and a treatment plan of actions, costs and risk decisions.
A crosswalk to NCA ECC that a person confirms
77 suggested links connect the 32 subdomains to NCA ECC categories. Each stays suggested until someone confirms or rejects it, with an optional note. ECC evidence can suggest at most level 3, because it cannot show the measurement and continuous improvement levels 4 and 5 describe, and it never sets the SAMA rating.
Evidence with a human decision
Upload evidence against any subdomain. Baseerah gives an opinion on its relevance, a reviewer accepts or rejects it, the person who uploaded a file can never approve it, and the AI opinion stays beside the human decision for the examiner.
Indicators that trace to subdomains
Derived indicators (subdomains not met, claimed but unevidenced, unanswered, stale) are computed from the answers. Measured key risk indicators name the subdomains they measure, which is also what level 4 asks for, and one outside appetite while every linked subdomain is answered as met is flagged as a contradiction.
Reports and history
Assessment reports in Word and PDF, a Baseerah summary on the dashboard, and a trend line across assessments that shows the climb towards level 3.
SAMA CSF frequently asked questions
What is the SAMA Cyber Security Framework?
It is the Saudi Central Bank's cybersecurity framework for the financial institutions it regulates. Version 1.0, dated May 2017, has four domains and 32 subdomains, each with a principle, an objective and control considerations, and measures maturity on six levels from 0 Non-existent to 5 Adaptive.
Who must comply with the SAMA Cyber Security Framework?
SAMA's Rulebook applies it to all banks, insurance and reinsurance companies, financing companies and credit bureaus operating in Saudi Arabia, and to the financial market infrastructure. Every domain applies to banks; the other institutions have named exceptions. Insurance supervision passed to the Insurance Authority, which began operating in November 2023, so insurers should check their regulator's current expectations.
What is SAMA maturity level 3?
Level 3 is Structured and formalized: cyber security controls are defined, approved and implemented in a structured and formalised way, and their implementation can be demonstrated; policies, standards and procedures are established; compliance with them is monitored, preferably using a governance, risk and compliance tool; and key performance indicators are defined, monitored and reported. SAMA states that Member Organizations should at least operate at level 3.
How does GRCLens score a SAMA CSF maturity assessment?
Each of the 32 subdomains gets a level from 0 to 5, or not applicable. The headline is the lowest applicable subdomain level with the number of subdomains at level 3 or above, each domain takes its lowest subdomain, and every subdomain below level 3 is listed as a finding, largest gap first. The mean is shown only as a trend.
What is the difference between SAMA CSF and NCA ECC?
NCA's Essential Cybersecurity Controls are the national baseline for government entities, their companies and critical infrastructure operators, assessed control by control. SAMA's Framework is the financial regulator's own, principle based and assessed by maturity level, with level 3 as the expected minimum. An institution within both scopes answers to both, and GRCLens runs them side by side, linked by a crosswalk that a person confirms link by link.
Can NCA ECC evidence count towards SAMA?
As a suggestion. Where the ECC categories linked to a subdomain are implemented, GRCLens suggests a level for it, never above 3, and suggests nothing when none are implemented. A person confirms or rejects each link, and the SAMA rating is always the one the assessor records.
Can GRCLens be hosted inside Saudi Arabia?
Yes. GRCLens can be deployed on-premises in your own data centre or in a compliant in-Kingdom cloud region, a common requirement for financial institutions with data residency obligations.
One platform, many obligations
See all supported frameworks → Every framework that applies in Saudi Arabia →
Talk to us about SAMA CSF
Security Solution Consultants provides SAMA cyber security framework advisory in Saudi Arabia alongside the platform, so you can combine tooling with hands-on expertise.