SAMA CSF · Cyber Security Framework of the Saudi Central Bank · Saudi Arabia
SAMA CSF compliance consulting for cyber security maturity that stands up to SAMA's review.
Meet the Cyber Security Framework of the Saudi Central Bank (SAMA), the cyber security rules for Saudi Arabia's banking, insurance and financing companies, with evidence rather than assertions: a board-mandated Cyber Security Committee, a cyber security function independent of IT, controls across all four domains at Level 3 or above, and records that show each one working. Sterling's expert and experienced consultants work alongside your CISO, IT, risk and procurement teams, build the evidence and stay involved after SAMA's review, in 60+ countries. We ensure a successful SAMA CSF compliance programme for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced financial-sector cybersecurity consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling builds the controls, the governance and the evidence; compliance is assessed by SAMA
8,100+ client engagements in 60+ countries.
SAMA CSF client experience
What it is
What is the SAMA CSF and what is it used for?
The SAMA Cyber Security Framework (SAMA CSF) is the Saudi Central Bank's framework for cyber security in the financial institutions it regulates in Saudi Arabia. SAMA's circular says the Framework "seeks to support our regulated entities in their efforts to have an appropriate cyber security governance and to build a robust infrastructure along with the necessary detective and preventive controls", and that it sets out controls and guidance on assessing maturity. The controls sit in four main domains, Cyber Security Leadership and Governance, Cyber Security Risk Management and Compliance, Cyber Security Operations and Technology, and Third Party Cyber Security, each divided into numbered subdomains.
It is assessed, not certified. SAMA rates maturity on a six-level scale, from Level 0, non-existent, to Level 5, adaptive, and its circular calls for "the third maturity level, as mentioned in the CSF, as a minimum". At Level 3, structured and formalised, controls are defined, approved and implemented in a structured and formalised way, and their implementation can be demonstrated. A practice that works but was never written down sits at Level 2, however capable the people running it.
Current text. SAMA issued the Cyber Security Framework, version 1.0, under circular No. 381000091275, for the Saudi banking, insurance and financing company sectors. For financing companies the circular set seven steps: an in-depth assessment against the Framework and its maturity levels, a business plan to meet at least the third maturity level, approval of the plan by the board, the approved plan sent to SAMA, quarterly progress reports from the end of the second quarter of 2019, full compliance by the end of the fourth quarter of 2019 (the timeline as amended by SAMA circular No. 51610/99), and follow-up by the Cyber Security Committee or its equivalent. The programme follows the circulars SAMA has addressed to your sector. SAMA CSF requirements explained, domain by domain
Who it is for
Who needs to comply with the SAMA CSF?
SAMA's circular ties the Framework to the Saudi banking, insurance and financing company sectors; the circulars your sector has received settle exactly what applies to you. Providers are reached through the third-party domain. Enquiries usually begin in one of four places:
- You are a Saudi bank, insurer or financing company whose last assessment fell short of Level 3. Policies without approval records, controls that run informally and a committee that rarely meets all score below the minimum. The remedy is formal, evidenced operation, subdomain by subdomain.
- You are building a regulated business from the start. A new financing company, a new group entity or a foreign institution entering the Kingdom needs the committee, the independent function, the CISO and the core processes designed together, not added one finding at a time.
- You provide technology, outsourcing or cloud services to Saudi financial institutions. Your clients must assess cyber risk in procurement, put security terms and audit rights into contracts, and obtain SAMA's approval before material outsourcing and before using cloud services, which in principle are located in Saudi Arabia. Their questionnaires follow the Framework's third-party domain.
- You hold ISO/IEC 27001 and assumed it covered the SAMA CSF. The ISMS is a strong base, but the Framework adds SAMA-specific governance, notifications, approvals and a maturity rating per subdomain that no certificate provides.
Business benefits
How SAMA CSF compliance strengthens cyber resilience and supervisory confidence
The Framework pays off where a cyber failure would hurt a Saudi financial institution most: a compromised channel, an incident nobody escalated, a cloud contract signed before anyone asked SAMA. We start with those exposures and give each an owner, a control and a record.
- A maturity rating you can defendEvery subdomain scored on evidence: approved documents, operating records and, where you aim higher, effectiveness measures. The level you report is the level the records support.
- Governance with real authorityA board that funds the work, a committee chaired from a control function and a CISO whose function is independent of IT in reporting line, budget and staff evaluation.
- Incidents escalated in timeMedium and high incidents recognised quickly, SAMA IT Risk Supervision informed immediately, media contact cleared with SAMA first and the formal report ready once operations resume.
- Faster outsourcing and cloud decisionsRisk assessment, due diligence, contract terms and the approval request to SAMA prepared together, so projects do not stall at the final step.
- Channels customers can trustOnline, mobile and phone banking, ATMs, point-of-sale terminals and SMS alerts secured to a written standard, with brand protection and take-down of fake apps and websites.
- One control set for several obligationsThe same asset register, risk method, access controls and incident process serving the SAMA CSF, PCI DSS, the NCA's controls and ISO/IEC 27001, which are commonly aligned in practice.
Judge the programme by what it proves: subdomains at Level 3 or above, test findings closed, incidents reported on time and vendor contracts carrying the security terms. A thicker policy manual is not a result.
Requirements
What are the main SAMA CSF requirements?
The requirements sit in section 3 of the Framework, in four domains and their numbered subdomains, and each is rated on SAMA's maturity scale from 0 to 5. The table maps them to practice. The programme then tests your arrangements against the Framework and the SAMA circulars that apply to you, control by control; legal interpretation stays with your legal advisers.
| Domain | What it requires of you | What it looks like in practice |
|---|---|---|
| 3.1 Cyber Security Leadership and Governance | A board with ultimate responsibility and a sufficient budget; a Cyber Security Committee mandated by the board and headed by an independent senior manager from a control function; a cyber security function independent of IT; a full-time CISO at senior management level; an approved strategy and policy; security built into project management; awareness and specialist training | Committee charter and quarterly minutes, an organisation chart with separate reporting lines, the CISO appointment file, the approved strategy and policy, and awareness and training records |
| 3.2 Cyber Security Risk Management and Compliance | A risk management process aligned with enterprise risk management, covering identification, analysis, response, and monitoring and review, with risk appetite and tolerance formally approved; a regulatory compliance process; compliance with PCI DSS, the EMV technical standard and the SWIFT Customer Security Controls Framework; periodic reviews, with annual review and penetration tests of customer and internet-facing services; independent audits to generally accepted auditing standards | A signed-off risk register and treatment plan, a register of regulatory requirements, PCI DSS and SWIFT evidence, penetration test reports with follow-up, and audit reports |
| 3.3.1 to 3.3.4 Operations and technology: people, premises, assets and architecture | Security across employment, from screening and confidentiality clauses to revoking access on leaving; physical security of premises, data centres and data rooms; a unified asset register with ownership, classification and handling; an approved security architecture applying security by design | Screening records, signed agreements, leaver checklists, visitor and CCTV controls, the classified asset register and reviewed architecture documents |
| 3.3.5 to 3.3.11 Operations and technology: access, applications, change, infrastructure and data | Identity and access management covering joiners, movers and leavers, with multi-factor authentication for all remote access and for sensitive and critical systems; a secure development life cycle; security in change management; infrastructure standards covering segmentation, malware protection, DDoS protection where applicable, and backup and recovery; cryptography and key management; bring your own device; secure disposal | Access reviews, MFA configuration, SDLC security gates, change records with security review, hardening standards, a key management procedure, the BYOD policy and disposal records |
| 3.3.12 and 3.3.13 Payment systems and electronic banking services | For payment systems, the Framework points to the SARIE Information Security Policy and the mada Rules and Standards Technical Book; for electronic banking, a security standard covering brand protection, online, mobile and phone banking, ATMs and point-of-sale terminals, and SMS notification services | A mapping to the SARIE and mada requirements, monitoring and take-down of fake apps and websites, ATM and POS hardening evidence, and the SMS notification rules |
| 3.3.14 to 3.3.17 Event, incident, threat and vulnerability management | Round-the-clock monitoring by a security operations centre with centralised log correlation; an incident process with classification, forensic capacity and an incident repository; SAMA IT Risk Supervision informed immediately of medium or high incidents, SAMA's no objection before media contact and a formal report once operations resume; threat intelligence from internal and external sources; risk-based vulnerability scanning with remediation timelines and patch management | SOC runbooks, the incident register with classifications, notifications and reports sent to SAMA, threat intelligence sources, and scans closed within the timelines |
| 3.4 Third Party Cyber Security | Security in contract and vendor management, from procurement risk assessment to escalation, exit and confidentiality terms; SAMA's approval before material outsourcing, per SAMA's outsourcing circular; for hybrid and public cloud, due diligence, SAMA's approval before use, services located in Saudi Arabia in principle, data segregation, audit rights, and exit with data returned and irreversibly deleted | Vendor risk assessments, contract clauses, SLA reports, SAMA approval letters for outsourcing and cloud, a cloud register with data locations, and exit plans |
What does useful SAMA CSF evidence look like?
Three layers for each subdomain: the approved document, the records that show it operates, and the periodic evaluation of effectiveness that many subdomains ask for and that Level 4 is built on. In practice: committee minutes, SAMA's no objection to the CISO, a signed-off risk register, access reviews and change records, penetration test follow-up, incident reports sent to SAMA, vendor assessments, SAMA approvals for outsourcing and cloud, and awareness records. We build all of it from your operations and hold it in Effivity from the first workshop.
SAMA CSF requirements explained, domain by domainCompliance process
How do you become SAMA CSF compliant?
Design the controls, operate them, measure them, then show them. Sterling designs the programme and builds it with your teams; SAMA assesses compliance and maturity, and financial institutions assess the providers they rely on.
- 01Confirm the scope: institution, sector and commitments.Establish the SAMA circulars your sector has received, the subsidiaries, channels and information assets in scope, the target maturity level and any plan or reporting commitment already made to SAMA.
- 02Gap analysis: rate every subdomain against the Framework and its maturity levels.The gap analysis tests each control, rates maturity from 0 to 5 on evidence rather than opinion, reuses ISO/IEC 27001, PCI DSS and SWIFT evidence, and sets actions, owners and dates.
- 03Build the governance, the policies and the technical controls.Committee and charter, the independent function and the CISO, strategy, policy and standards, the risk process, incident and SAMA notification procedures, and vendor, outsourcing and cloud controls, weakest subdomains first.
- 04Operate, measure and audit.Run the processes long enough to leave records, start the effectiveness measures, then the internal audit and the Cyber Security Committee's review; findings surface internally first and close with evidence.
- 05Complete SAMA's review.Submit the assessments, plans and progress reports SAMA asks for, answer its questions from an evidence pack that already exists, and act on any finding it raises.
- 06Keep maturity rising.Periodic reviews, annual penetration tests of customer and internet-facing services, awareness through the year, incidents reported, and the move from Level 3 towards Level 4 planned.
Judge a SAMA CSF offer by what it leaves behind: who rates maturity and on what evidence, who drafts the charter and policies for your institution rather than copying them, who prepares the approval requests to SAMA, what your people will be taught, and where the records will live. An offer of a "SAMA CSF certificate" sells something SAMA does not issue. How to choose a credible SAMA CSF provider · The certification buyer's checklist
Cost
How much does SAMA CSF compliance cost?
The price follows the institution: the entities and information assets in scope, the maturity you start from and the level you target, your channels, the vendor, outsourcing and cloud arrangements to bring under control, and the ISO/IEC 27001 or PCI DSS groundwork already in place. A small financing company and a bank with national channels need different programmes; either way, a Sterling proposal itemises every component under one all-inclusive proposal.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Subdomains below target, entities and channels, the existing ISMS or PCI DSS evidence, deliverables, and whether your team or ours carries the work (Design™ or Drive™) |
| Independent testing and review | Penetration testers, red-team providers and any external auditor or assessor you appoint, shown separately |
| Internal resources | CISO, IT, risk, procurement, HR and business time; tooling such as log monitoring or access management; committee and board time; training |
| Software and learning | Part of every Sterling engagement: Effivity for the programme and Academy access for your people, with users, courses and access period fixed in the proposal |
| Continued support | Maturity reassessment, reviews, test follow-up, awareness and internal audit, under Sustain™ |
What moves the price
- Entities, sites and channels in scope, and the subsidiaries the programme must reach
- The distance between today's maturity and the level you target
- Whether an ISMS, a security operations centre, an asset register and a vendor inventory exist
- Cloud and outsourcing arrangements awaiting SAMA approval or contract changes
- SAMA findings, reporting commitments or client deadlines already set
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, set out in writing
- Tester, auditor and legal fees shown separately, so the full cost can be compared
- Effivity, training and Academy access itemised at no additional cost
- Payments tied to deliverables, never to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does SAMA CSF compliance take?
Six to twelve months is a realistic range for reaching Level 3 across the Framework from a low base: nearer six where an ISO/IEC 27001 system, a security operations centre and a vendor inventory already work, nearer twelve where the committee, the independent function and most processes are new. The pace is set by approvals, by processes running long enough to leave records, and by vendor and cloud remediation. Every milestone is tracked in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to the CISO, IT, risk, procurement and business owners, existing documents and any earlier maturity assessment |
| Build and implementation | Committee and board approvals, the policy and standards set, tooling changes, vendor renegotiation and training |
| Operation, measurement and review | Controls running long enough to show evidence, effectiveness measures started, then internal audit and committee review |
| Regulator or customer review | When SAMA asks for assessments, plans or progress reports, any follow-up it requires and, for providers, their clients' audit dates |
If SAMA or a client has already set a date, tell us at the start; we will say what can be evidenced by then and which decisions cannot wait. Level 3 promised within a few weeks, before anyone has looked at your records, is a sales line, not a plan.
Challenges
Common SAMA CSF implementation challenges
SAMA CSF programmes tend to slow down at the same five points. Each has a practical way through.
The cyber security function still sits under IT.
The Framework asks for a function independent of information technology, with separate reporting lines, budgets and staff evaluations, reporting to the CEO or managing director or to the general manager of a control function. We redraw the structure, job descriptions and committee charter, and prepare the board papers.
Assessments claim Level 3 that the records cannot show.
An unwritten standard practice is Level 2 by definition, and a written control never approved falls short of Level 3. We formalise what already works, take it through approval and collect the records that demonstrate implementation before the rating is reported.
Cloud and outsourcing projects move faster than the approvals.
SAMA's approval comes before cloud services are used or the cloud contract is signed, and before material outsourcing. We assemble the risk assessment, due diligence, data location, contract terms and exit plan into one approval request, early.
Nobody is sure which incidents SAMA must hear about.
A classification scheme with clear medium and high criteria, a named decision owner, prepared notification wording and a formal report template make the immediate notice to SAMA IT Risk Supervision routine, and media statements wait for SAMA's no objection.
Awareness reaches staff but not third parties or customers.
The Framework expects awareness programmes for staff, third parties and customers, tailored to each group, run periodically and throughout the year, and evaluated for effectiveness. We plan the channels, the messages and the measures for all three.
Your engagement
What your SAMA CSF engagement includes
The agreed scope covers everything an assessed programme needs, delivered by one team for one all-inclusive proposal: analysis, governance, controls, software, training and an internal review that proves the programme runs.
Scope, gap analysis and maturity baseline
Entities, assets and channels confirmed, every subdomain rated against the maturity model, and actions, owners and dates agreed before work starts.
Governance, policies and standards
Committee charter, strategy, policy, security standards and procedures, on Sterling's template sets, rewritten around your institution and its channels.
Effivity ISO & GRC software
Your programme runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement, with a board and committee briefing on their duties under the Framework.
Internal audit and committee review
Performed or facilitated as agreed, independent of the people who built the controls, with findings closed with evidence before SAMA looks.
SAMA review readiness and support
The assessments, plans and progress reports SAMA requests prepared with you, and support through its follow-up.
Compliance and maturity are assessed by SAMA. Sterling consults; it does not provide legal advice.
How we deliver
How Sterling supports your SAMA CSF implementation
Every SAMA CSF engagement runs on Sterling OS™, our delivery operating system: five phases, each with named deliverables, decision owners and evidence. Choose how much of the work your team keeps; the method, the software and the accountability do not change.
- 01Design™Guided implementation: your CISO and control owners build the programme, coached by Sterling through templates, workshops and reviews.
- 02Drive™Fully managed consulting: Sterling consultants write, configure and roll out the agreed controls with your IT, risk, procurement and business teams.
- 03Sustain™Year-round upkeep: maturity reassessment, policy reviews, penetration test follow-up, incident reviews, awareness and internal audit.
- 04Automate™The programme in Effivity: assets, risks, access reviews, incidents, vulnerabilities, vendors, approvals and committee decisions in one workspace.
- 05Revise™New SAMA circulars, changes of scope, entities or channels, and integration with ISO/IEC 27001, PCI DSS or the NCA's controls.
In the first week we agree the lead, the meeting rhythm, the deliverables and who decides. Progress is reviewed against those commitments, so a gap shows up early rather than in SAMA's findings.
How Sterling OS™ worksOften combined with
Standards organisations pair with SAMA CSF (Saudi Arabia)
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
- APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
- Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
- BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
- CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
Effivity · SAMA CSF programme software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the SAMA Cyber Security Framework, version 1.0.
Every Sterling SAMA CSF engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so committee decisions, policies, assets, risks, access reviews, incidents, vulnerabilities, vendors, approvals, awareness and audits live in one place, recorded as the work happens. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Committee, charter and CISO records
Committee membership, charter, quarterly meetings and actions, the CISO's appointment file and the board's budget approvals, each dated with its evidence.
Risk register, appetite and treatment plans
Risks assessed at project start, before critical change, before outsourcing and at product launch, treated within the approved appetite and signed off by their business owners.
One register of information assets
Business processes, applications and infrastructure with owners, custodians and classification, updated as new assets are discovered.
Joiners, movers, leavers and privileged access
Access changes triggered by HR events, periodic reviews, privileged and remote access with multi-factor authentication, and leaver revocations, each with the approval that shows the control ran.
Incidents classified, notified and closed
Each incident logged with its classification, the time SAMA IT Risk Supervision was informed where required, the formal report, root cause and corrective action, all in one incident repository.
Scans, remediation deadlines and patching
Scan results by asset, remediation within the timelines set per classification, patching, and penetration tests of customer and internet-facing services.
Vendors, outsourcing and cloud approvals
Due diligence, contract clauses, SLA reporting, approval requests to SAMA, cloud data locations and exit plans, per provider.
Awareness for staff, third parties and customers
The year's awareness plan, campaigns by target group, effectiveness measures and each employee's training record, linked to Sterling Academy.
What this means at the audit
SAMA, your internal auditors and your clients' reviewers ask for the same things: committee minutes, the risk register, access reviews, penetration test follow-up, the incident repository, vendor assessments and approvals, and awareness records. In Effivity each is a live record with a date, an owner and evidence, and Sustain™ works in the same workspace, so the next assessment starts from records.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Existing registers, policies and vendor lists imported, not retyped
- Admin and user training for security, IT, risk and procurement teams
- Modules for ISMS, business continuity, privacy and quality as the programme grows
SAMA CSF client experience
Client letters on file, available on request.
Signed client letters for SAMA CSF are available on request. The client feedback wall lists every letter by standard.
Programmes with the SAMA CSF in scope
How the SAMA CSF sits beside ISO/IEC 27001 and PCI DSS.
- 01Integrated management systems
Saudi financial institutions: information security, card data and the SAMA CSF as one programme
How such a programme typically runs: an ISO/IEC 27001 ISMS supplies the risk method, the asset register and the core controls; PCI DSS covers card data; the SAMA CSF adds the governance it describes, a maturity rating per subdomain, incident notification to SAMA, electronic banking controls and SAMA approvals for outsourcing and cloud. One inventory, one evidence base and one audit calendar serve all three.
Sterling Academy · SAMA CSF e-learning
Staff, third parties and customers: the SAMA CSF expects awareness for all three.
Academy courses combine short video lessons with practice checkpoints and end in a final exam; every learner who passes receives a numbered Certificate of Completion, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- SAMA CSF awareness for every employee, part of the year-round awareness programme the Framework expects
- Specialist courses for the CISO's team, control owners, incident handlers and vendor managers
- Internal auditor training, as applicable to your standard, for the people who will audit the programme, as part of the engagement
- Completion tracked by department, reportable to SAMA reviewers or client auditors
- New joiners trained when they start, as the Framework's human resources controls expect
- A Sterling consultant available when learners have questions
Where we work
Where Sterling delivers SAMA CSF (Saudi Arabia)
Keep exploring
Explore more about SAMA CSF (Saudi Arabia)
Watch a video on how to comply with SAMA CSF here.
Watch a video on SAMA CSF requirements here.
SAMA CSF resources
Services for SAMA CSF (Saudi Arabia)
Why Sterling
Want successful SAMA CSF compliance? Come to Sterling.
From a single financing company to a banking group with national channels and many vendors, Sterling builds one SAMA CSF programme with clear ownership in each function. Many Sterling clients are the technology, BPO and cloud providers that financial institutions depend on, so we know what a Saudi institution needs to see from its providers.
Security programmes in 60+ countries since 2003
Information security, continuity and risk programmes for financial services firms, BPOs and software companies across every region we serve, with one engagement team accountable for yours.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal; testers, auditors and legal advisers are priced apart. No surprises, ever.
Controls your teams can run
Fewer documents, more evidence: committee decisions, access reviews, incident handling and vendor controls tied to daily operations, so the maturity holds after the project team has gone.
Expert and experienced consultants
Consultants advising on management systems across sectors and countries since 2003, who build the SAMA CSF programme right the first time, so SAMA's next request finds the records already in place.
The Sterling Promise
What our SAMA CSF compliance success guarantee means
Sterling stays engaged until the agreed SAMA CSF outcome is reached: governance approved and operating, every subdomain in scope evidenced at the target maturity level, incidents handled through a tested process with SAMA notification built in, and vendor, outsourcing and cloud controls in force, with your team able to answer SAMA's next request itself. The included software and learning turn the fee into lasting capability.
The engagement defines the entities, scope, target maturity, outcome and responsibilities. You provide accurate information and access, take the decisions the programme needs and operate the agreed controls. SAMA assesses compliance and maturity, and legal interpretation rests with your legal advisers. Sterling's commitment is the agreed programme support, not legal advice and not a guarantee against incidents, findings or supervisory action.
Once the programme runs
What happens after SAMA CSF compliance is in place?
The Framework runs on recurring cycles: the Cyber Security Committee meeting at least quarterly, the policy reviewed through its defined process, periodic reviews of critical assets with annual reviews and penetration tests of customer and internet-facing services, awareness activity throughout the year, audits to the audit plan, vulnerability scans at risk-based intervals and incidents reported to SAMA as they occur. Moving from Level 3 to Level 4 then means assessing whether each control works and documenting the improvements.
Under Sterling OS™ Sustain™ we run that calendar with you, ready whenever SAMA or a client asks.
FAQs
Frequently asked questions about the SAMA CSF
Is there such a thing as SAMA CSF certification?
No. SAMA does not certify institutions against the Framework, and no accredited scheme exists for it. SAMA assesses compliance and maturity through the assessments, plans and reports it requires. A "SAMA CSF certified" badge is its issuer's own label. ISO/IEC 27001 certificates from accredited bodies and PCI DSS attestations support the evidence, but they certify nothing under the SAMA CSF.
Which institutions must comply with the SAMA CSF?
SAMA's circular links the Framework to the Saudi banking, insurance and financing company sectors, and gave financing companies until the end of 2019 to comply fully. The circulars your sector has received are the authority on applicability, so we confirm them at the start. Technology, outsourcing and cloud providers are not addressed directly, but the Framework's third-party domain reaches them through their clients' procurement, contracts and approvals.
What maturity level does SAMA expect?
At least Level 3. SAMA's circular asks for a plan "to meet all requirements of the third maturity level, as mentioned in the CSF, as a minimum". Level 4, managed and measurable, adds periodic assessment of effectiveness with the evaluations documented; Level 5, adaptive, places controls under a continuous improvement plan.
Does ISO/IEC 27001 certification make us SAMA CSF compliant?
No, although it is a strong base and the two are commonly aligned in practice. An ISMS already holds a risk method, an asset inventory, access and change controls and internal audit. It does not by itself produce the governance the Framework describes, the CISO's appointment with SAMA's no objection, incident notification to SAMA, SAMA approvals for material outsourcing and cloud, compliance with PCI DSS, EMV and the SWIFT Customer Security Controls Framework, or a maturity rating per subdomain.
We provide technology or outsourcing services to Saudi banks. What will they ask of us?
Expect a cyber security risk assessment during procurement, security requirements in the tender, testing of the agreed requirements, an incident escalation route, exit and renewal terms, with escrow where relevant, mutual confidentiality, and your client's right to review and audit you periodically. For cloud services, your client must obtain SAMA's approval before use, keep to services located in Saudi Arabia unless SAMA explicitly approves otherwise, and secure data segregation, audit rights and exit terms under which you return and irreversibly delete its data.
How must a cyber security incident be reported to SAMA?
Classify it first. The Framework requires SAMA IT Risk Supervision to be informed immediately when a medium or high classified incident has occurred and been identified, SAMA's no objection before any media interaction about it, and a formal incident report after operations resume, covering among other things the title, the classification, when the incident occurred and was detected, the information assets involved, technical details, root-cause analysis and corrective activities. Check SAMA's current instructions for the reporting channel.
What does the Framework require of the CISO and the Cyber Security Committee?
The board mandates a Cyber Security Committee headed by an independent senior manager from a control function, with senior managers from relevant departments and the CISO as members and internal audit able to attend as an observer; its charter sets objectives, roles, the minimum number of participants and meetings at least quarterly. The CISO is a full-time senior manager leading a function independent of IT; the institution must ensure the CISO is of Saudi nationality and sufficiently qualified, and obtain SAMA's no objection to the appointment.
How does the SAMA CSF relate to the NCA's Essential Cybersecurity Controls?
They come from different authorities. The Essential Cybersecurity Controls, currently ECC-2:2024, are issued by Saudi Arabia's National Cybersecurity Authority; the SAMA CSF is the Saudi Central Bank's framework for the institutions it regulates. Which of them applies to your institution, and how, is for SAMA and the NCA to confirm. Many controls overlap, so one control set and one evidence base can be mapped to both.
What does Sterling's 100% success guarantee mean for the SAMA CSF?
Sterling stays with you until the agreed SAMA CSF outcome is reached, through gap analysis, implementation, internal audit and your first SAMA review. The engagement defines the scope, target maturity and outcome; SAMA's assessment, and any finding or instruction, remain SAMA's.
Before the first call
Prepare a useful SAMA CSF readiness brief
No maturity report is needed to start. A short account of your institution, its channels and who is asking is enough, built on seven answers:
- Who is asking, and for what: SAMA, your internal audit, a client's security questionnaire or your own board?
- Which entities, subsidiaries and channels are in scope, and which SAMA circulars has your sector received?
- What maturity rating did your last assessment give, and which subdomains scored lowest?
- Is the cyber security function independent of IT, and is a CISO in post with SAMA's no objection?
- Which vendor, outsourcing and cloud arrangements support critical services, and which are awaiting SAMA's approval?
- What exists already: an ISO/IEC 27001 system, PCI DSS compliance, a security operations centre, incident procedures?
- Who can decide and commit time (board, committee, CISO, IT, risk, procurement), and which dates must the plan meet?
With them we can size the programme and quote an all-inclusive proposal. They start a conversation; they are not a scored assessment, a legal opinion or a forecast of SAMA's view.
Don’t be fooled by certification scams
If it takes ten days, it is not SAMA CSF compliance.
Because SAMA issues no certificate for the Framework, the market fills the gap with substitutes: "SAMA CSF certified" badges, policy packs with another institution's name still in the footer, maturity scores assigned without looking at a single record, and tools sold as SAMA-compliant out of the box. They cost less than a programme until SAMA asks for the committee minutes, or a client asks how an incident was classified.
How to choose a credible SAMA CSF provider
- Ask for the deliverables by name: a committee charter and minutes, an approved strategy and policy, standards and procedures, an asset register, a risk register, incident and SAMA notification procedures, vendor and cloud controls, and trained people, each with an author.
- Ask what any offered "SAMA CSF certificate" actually is. SAMA does not certify institutions against the Framework; a badge from a consultant or a software vendor is that company's own label, not SAMA's view and not an accredited statement.
- Ask how maturity will be rated, subdomain by subdomain, on documents, approvals and operating records, and who checks the ratings before they reach SAMA.
- Ask who carries each task, which testing, audit or legal costs sit outside the fee, and who supports you when SAMA follows up or an incident tests the process.
- Ask what your board, staff, third parties and customers will learn, and where the evidence will be held. Records kept in a consultant's folders are records you do not control.
- Walk away from "SAMA CSF compliant in ten days", certified seals and one policy pack for every institution. Compliance is shown by controls that operate and records that prove it, and the board keeps the ultimate responsibility for cyber security.
Keep exploring
More on SAMA CSF (Saudi Arabia) and related standards
More in Financial services, payments & AML
Talk to a consultant
Plan your SAMA CSF compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice