Compliance walkthrough
How to comply with the SAMA Cyber Security Framework: video walkthrough
A walkthrough of building a SAMA Cyber Security Framework programme, from the maturity baseline to the evidence SAMA assesses.
Key takeaways
- SAMA CSF applies to Saudi banking, insurance and financing companies.
- Controls sit in four main domains with numbered subdomains.
- Maturity is rated on a scale from 0 to 5.
- Governance includes a board-mandated committee and a CISO independent of IT.
- There is no SAMA CSF certificate; SAMA assesses compliance and maturity.
The Saudi Central Bank's cyber security framework
The SAMA Cyber Security Framework is the Saudi Central Bank's framework for cyber security in the financial institutions it regulates. SAMA's circular describes it as supporting regulated entities in having appropriate cyber security governance and building a robust infrastructure with the necessary detective and preventive controls, and it sets out controls and guidance on assessing maturity. The controls sit in four main domains: Cyber Security Leadership and Governance, Cyber Security Risk Management and Compliance, Cyber Security Operations and Technology, and Third Party Cyber Security.
It is assessed, not certified. SAMA rates compliance and maturity on a scale from 0 to 5, and certificates such as ISO/IEC 27001 or PCI DSS evidence support parts of it, never the whole. This short film walks through how an institution builds its programme.
Design, operate, measure, show
Confirm the scope: the SAMA circulars the sector has received, the subsidiaries, channels and information assets in scope, the target maturity level and any plan or reporting commitment already made to SAMA. A gap analysis then rates current arrangements against each subdomain on the maturity scale, giving a baseline.
Governance is built first: a board with ultimate responsibility and a sufficient budget, a Cyber Security Committee mandated by the board and headed by an independent senior manager from a control function, a cyber security function independent of IT led by a full-time CISO at senior management level, an approved strategy and policy, security built into project management, and awareness and specialist training. Risk management and compliance, operations and technology controls, and third-party cyber security follow, each documented, operated and measured so that maturity can be demonstrated rather than claimed. Financial institutions also assess the technology, outsourcing and cloud providers they rely on. SAMA assesses compliance and maturity; legal interpretation stays with your advisers.
Sterling's expert and experienced consultants design the programme and implement governance, controls and evidence with your teams under Sterling OS™, with the work held in Effivity.
SAMA CSF (Saudi Arabia) at a glance
- Purpose
- Cyber security governance and controls for Saudi financial institutions, with maturity rated on a six-level scale from 0 to 5
- Relevant to
- The Saudi banking, insurance and financing company sectors named in SAMA's circular and, through their contracts, the technology, outsourcing and cloud providers that serve them
- Edition
- Cyber Security Framework version 1.0, issued under SAMA circular No. 381000091275; financing companies had to comply fully by the end of 2019
- Certification
- None exists. SAMA assesses compliance and maturity; ISO/IEC 27001 or PCI DSS evidence supports parts of it, never the whole
- Sterling's role
- Gap analysis and maturity baseline; governance, controls and evidence built with your team, Effivity, training and internal audit, then Sustain™
- Cost and timing
- Total investment for a SAMA CSF compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 6 to 12 months
SAMA CSF (Saudi Arabia): questions people ask
Is there such a thing as SAMA CSF certification?
No. SAMA does not certify institutions against the Framework, and no accredited scheme exists for it. SAMA assesses compliance and maturity through the assessments, plans and reports it requires. A "SAMA CSF certified" badge is its issuer's own label. ISO/IEC 27001 certificates from accredited bodies and PCI DSS attestations support the evidence, but they certify nothing under the SAMA CSF.
Which institutions must comply with the SAMA CSF?
SAMA's circular links the Framework to the Saudi banking, insurance and financing company sectors, and gave financing companies until the end of 2019 to comply fully. The circulars your sector has received are the authority on applicability, so we confirm them at the start. Technology, outsourcing and cloud providers are not addressed directly, but the Framework's third-party domain reaches them through their clients' procurement, contracts and approvals.
What maturity level does SAMA expect?
At least Level 3. SAMA's circular asks for a plan "to meet all requirements of the third maturity level, as mentioned in the CSF, as a minimum". Level 4, managed and measurable, adds periodic assessment of effectiveness with the evaluations documented; Level 5, adaptive, places controls under a continuous improvement plan.
Does ISO/IEC 27001 certification make us SAMA CSF compliant?
No, although it is a strong base and the two are commonly aligned in practice. An ISMS already holds a risk method, an asset inventory, access and change controls and internal audit. It does not by itself produce the governance the Framework describes, the CISO's appointment with SAMA's no objection, incident notification to SAMA, SAMA approvals for material outsourcing and cloud, compliance with PCI DSS, EMV and the SWIFT Customer Security Controls Framework, or a maturity rating per subdomain.
We provide technology or outsourcing services to Saudi banks. What will they ask of us?
Expect a cyber security risk assessment during procurement, security requirements in the tender, testing of the agreed requirements, an incident escalation route, exit and renewal terms, with escrow where relevant, mutual confidentiality, and your client's right to review and audit you periodically. For cloud services, your client must obtain SAMA's approval before use, keep to services located in Saudi Arabia unless SAMA explicitly approves otherwise, and secure data segregation, audit rights and exit terms under which you return and irreversibly delete its data.
Keep exploring
Related to this video
The complete guide
Everything on SAMA CSF (Saudi Arabia)
Start with the SAMA CSF (Saudi Arabia) page, or go straight to the guide you need.
On the SAMA CSF (Saudi Arabia) page
- What are the main SAMA CSF requirements?
- How do you become SAMA CSF compliant?
- How much does SAMA CSF compliance cost?
- How long does SAMA CSF compliance take?
- Who needs to comply with the SAMA CSF?
- How SAMA CSF compliance strengthens cyber resilience and supervisory confidence
- Frequently asked questions about the SAMA CSF
Often combined with SAMA CSF (Saudi Arabia)
More videos: Financial services, payments and AML
Talk to a consultant
Plan your SAMA CSF compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice