Two-minute brief
SAMA Cyber Security Framework requirements explained: video brief
A two-minute brief on the four domains of the SAMA Cyber Security Framework and how maturity is rated.
Key takeaways
- SAMA CSF has four domains in section 3 of the Framework.
- Each subdomain is rated on a maturity scale from 0 to 5.
- The CISO and cyber security function must be independent of IT.
- Third-party cyber security reaches technology and cloud providers through contracts.
- Other certificates support parts of SAMA CSF, never the whole.
Four domains, rated for maturity
The requirements of the SAMA Cyber Security Framework sit in section 3 of the Framework, in four domains and their numbered subdomains, and each is rated on SAMA's maturity scale from 0 to 5. This short film walks through the domains. Legal interpretation stays with legal advisers.
Domain 3.1, Cyber Security Leadership and Governance, asks for ultimate responsibility held by the board, which also provides a sufficient budget; a board-mandated Cyber Security Committee, led by an independent senior manager drawn from a control function; a cyber security function kept separate from IT; a Chief Information Security Officer working full time at senior management level; an approved strategy and policy; security built into project management; and awareness and specialist training. The evidence includes a committee charter and minutes, an organisation chart with separate reporting lines, and the approved strategy and policy.
Risk, operations, third parties and maturity
Domain 3.2, Cyber Security Risk Management and Compliance, covers the identification and treatment of cyber security risk and regulatory compliance. Domain 3.3, Cyber Security Operations and Technology, covers the protective and detective controls across assets, identity and access, applications, networks, data, monitoring and incident management. Domain 3.4, Third Party Cyber Security, covers outsourcing, cloud services and other third-party arrangements, which is why the technology, outsourcing and cloud providers that serve financial institutions are reached through their contracts.
Each subdomain is rated on the maturity scale, and institutions work towards the level SAMA expects. The Framework, version 1.0, was issued under a SAMA circular and applies to the Saudi banking, insurance and financing company sectors named in it. There is no certificate: SAMA assesses compliance and maturity, and ISO/IEC 27001 or PCI DSS evidence supports parts of it, never the whole.
SAMA's circular asks institutions to meet all requirements of the third maturity level as a minimum. The board mandates a Cyber Security Committee headed by an independent senior manager from a control function, with the CISO as a member, and medium or high classified incidents are reported to SAMA IT Risk Supervision immediately.
SAMA CSF (Saudi Arabia) at a glance
- Purpose
- Cyber security governance and controls for Saudi financial institutions, with maturity rated on a six-level scale from 0 to 5
- Relevant to
- The Saudi banking, insurance and financing company sectors named in SAMA's circular and, through their contracts, the technology, outsourcing and cloud providers that serve them
- Edition
- Cyber Security Framework version 1.0, issued under SAMA circular No. 381000091275; financing companies had to comply fully by the end of 2019
- Certification
- None exists. SAMA assesses compliance and maturity; ISO/IEC 27001 or PCI DSS evidence supports parts of it, never the whole
- Sterling's role
- Gap analysis and maturity baseline; governance, controls and evidence built with your team, Effivity, training and internal audit, then Sustain™
- Cost and timing
- Total investment for a SAMA CSF compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 6 to 12 months
SAMA CSF (Saudi Arabia): questions people ask
Is there such a thing as SAMA CSF certification?
No. SAMA does not certify institutions against the Framework, and no accredited scheme exists for it. SAMA assesses compliance and maturity through the assessments, plans and reports it requires. A "SAMA CSF certified" badge is its issuer's own label. ISO/IEC 27001 certificates from accredited bodies and PCI DSS attestations support the evidence, but they certify nothing under the SAMA CSF.
Which institutions must comply with the SAMA CSF?
SAMA's circular links the Framework to the Saudi banking, insurance and financing company sectors, and gave financing companies until the end of 2019 to comply fully. The circulars your sector has received are the authority on applicability, so we confirm them at the start. Technology, outsourcing and cloud providers are not addressed directly, but the Framework's third-party domain reaches them through their clients' procurement, contracts and approvals.
What maturity level does SAMA expect?
At least Level 3. SAMA's circular asks for a plan "to meet all requirements of the third maturity level, as mentioned in the CSF, as a minimum". Level 4, managed and measurable, adds periodic assessment of effectiveness with the evaluations documented; Level 5, adaptive, places controls under a continuous improvement plan.
Does ISO/IEC 27001 certification make us SAMA CSF compliant?
No, although it is a strong base and the two are commonly aligned in practice. An ISMS already holds a risk method, an asset inventory, access and change controls and internal audit. It does not by itself produce the governance the Framework describes, the CISO's appointment with SAMA's no objection, incident notification to SAMA, SAMA approvals for material outsourcing and cloud, compliance with PCI DSS, EMV and the SWIFT Customer Security Controls Framework, or a maturity rating per subdomain.
We provide technology or outsourcing services to Saudi banks. What will they ask of us?
Expect a cyber security risk assessment during procurement, security requirements in the tender, testing of the agreed requirements, an incident escalation route, exit and renewal terms, with escrow where relevant, mutual confidentiality, and your client's right to review and audit you periodically. For cloud services, your client must obtain SAMA's approval before use, keep to services located in Saudi Arabia unless SAMA explicitly approves otherwise, and secure data segregation, audit rights and exit terms under which you return and irreversibly delete its data.
Keep exploring
Related to this video
The complete guide
Everything on SAMA CSF (Saudi Arabia)
Start with the SAMA CSF (Saudi Arabia) page, or go straight to the guide you need.
On the SAMA CSF (Saudi Arabia) page
- What are the main SAMA CSF requirements?
- How do you become SAMA CSF compliant?
- How much does SAMA CSF compliance cost?
- How long does SAMA CSF compliance take?
- Who needs to comply with the SAMA CSF?
- How SAMA CSF compliance strengthens cyber resilience and supervisory confidence
- Frequently asked questions about the SAMA CSF
Often combined with SAMA CSF (Saudi Arabia)
More videos: Financial services, payments and AML
Talk to a consultant
Plan your SAMA CSF compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice