Saudi Arabia SAMA Cybersecurity Framework v1.0

Why does it matter?

The framework is mandated by SAMA, which owns it and updates it, while member organizations are responsible for adopting and implementing it (section 1.5), and the Saudi Central Bank alone interprets its principles, objectives and control considerations (section 1.6). Its requirements reach into governance: the board carries ultimate responsibility for cyber security (section 3.1), a full-time CISO of Saudi nationality is appointed with SAMA's no objection (3.1.1, control 9), the cyber security function is independent of the IT function (3.1.1, control 6), and SAMA approval is needed before material outsourcing (3.4.2) and before cloud services are used (3.4.3). SAMA uses the framework to assess maturity and to compare member organizations with each other (section 1.1).

Key benefits include:

• A common approach across the sector

Section 1.1 states the framework's three objectives: a common approach to cyber security within member organizations, an appropriate maturity level of controls, and cyber security risks that are properly managed throughout each organization.

• Maturity that can be measured

The six-level model in section 2.4 defines each level with criteria, from level 0 (non-existent) to level 5 (adaptive); levels 3, 4 and 5 require all criteria of the preceding levels, and SAMA expects level 3 or higher.

• Board-level governance

A board-mandated cyber security committee headed by an independent senior manager from a control function, a charter with at least quarterly meetings and sufficient budget are control considerations under subdomain 3.1.1.

• Regulator expectations written into the controls

The controls state when SAMA must be informed or asked: medium or high classified incidents immediately (3.3.15), approval before launching a new electronic banking service (3.3.13), material outsourcing (3.4.2), and cloud services and data outside Saudi Arabia (3.4.3).

• A route for exceptions

A control that cannot be tailored or implemented is handled through compensating controls, internal risk acceptance and a formal waiver request to SAMA, following the process in Appendix D and the form in Appendix E (section 2.2).

How does it work?

Chapter 2 explains the structure. Each of the four domains contains subdomains focused on a specific topic; for each subdomain the framework states a principle that summarizes the required controls, an objective that describes their purpose, and control considerations, the mandated controls that should be considered, numbered uniquely and nested up to four levels (section 2.1). Member organizations are expected to embed the principles and achieve the objectives, with the control considerations giving direction. Section 1.7 names the audience: senior and executive management, business owners, owners of information assets, CISOs and those who define, implement and review cyber security controls.

Maturity is measured on the section 2.4 model: level 0 non-existent, 1 ad-hoc, 2 repeatable but informal, 3 structured and formalized, 4 managed and measurable, 5 adaptive. Level 3 requires defined, approved and implemented controls, a documentation pyramid of board-endorsed policy, standards and procedures, monitored compliance and key performance indicators (section 2.4.1). Level 4 adds key risk indicators with thresholds and trend reporting (section 2.4.2, with additional requirements for banks under Circular No. 29814/67), and level 5 adds continuous improvement, integration with enterprise risk management and evaluation against peer and sector data (section 2.4.3).

Compliance is validated through a periodic self-assessment based on a questionnaire, which SAMA reviews and audits to determine the level of compliance and the maturity level (section 2.3). All domains apply to banks; for other financial institutions section 1.4 makes exceptions: alignment with the banking sector's cyber security strategy under 3.1.2 is mandatory only when applicable, subdomains 3.2.3 and 3.3.12 are excluded, and 3.3.13 is excluded except that multi-factor authentication is required where online customer services are offered. An organization that handles cardholder data or SWIFT services still implements PCI DSS or the SWIFT Customer Security Controls Framework.

Key Elements

• 3.1 Cyber Security Leadership and Governance

Seven subdomains: 3.1.1 Cyber Security Governance, 3.1.2 Cyber Security Strategy, 3.1.3 Cyber Security Policy, 3.1.4 Cyber Security Roles and Responsibilities, 3.1.5 Cyber Security in Project Management, 3.1.6 Cyber Security Awareness and 3.1.7 Cyber Security Training.

• 3.2 Cyber Security Risk Management and Compliance

Five subdomains: 3.2.1 Cyber Security Risk Management (with 3.2.1.1 identification, 3.2.1.2 analysis, 3.2.1.3 response and 3.2.1.4 monitoring and review), 3.2.2 Regulatory Compliance, 3.2.3 Compliance with (Inter)national Industry Standards, 3.2.4 Cyber Security Review and 3.2.5 Cyber Security Audits.

• 3.3 Cyber Security Operations and Technology

Seventeen subdomains: 3.3.1 Human Resources, 3.3.2 Physical Security, 3.3.3 Asset Management, 3.3.4 Cyber Security Architecture, 3.3.5 Identity and Access Management, 3.3.6 Application Security, 3.3.7 Change Management, 3.3.8 Infrastructure Security, 3.3.9 Cryptography, 3.3.10 Bring Your Own Device, 3.3.11 Secure Disposal of Information Assets, 3.3.12 Payment Systems, 3.3.13 Electronic Banking Services, 3.3.14 Cyber Security Event Management, 3.3.15 Cyber Security Incident Management, 3.3.16 Threat Management and 3.3.17 Vulnerability Management.

• 3.4 Third Party Cyber Security

Three subdomains: 3.4.1 Contract and Vendor Management, 3.4.2 Outsourcing and 3.4.3 Cloud Computing, which applies to hybrid and public cloud services and not to private cloud.

• Cyber security maturity model (section 2.4)

Six levels from 0 to 5 with definitions and criteria in Table 1; member organizations should operate at level 3 or higher, and each higher level requires all criteria of the levels below it.

• Incident reporting to SAMA (3.3.15)

Member organizations inform SAMA IT Risk Supervision immediately of a medium or high classified incident, obtain its no objection before any media interaction, and submit a formal report after resuming operations covering the incident's classification, timing, assets, root cause, corrective actions, impact and costs.

• Cloud computing conditions (3.4.3)

A risk assessment and due diligence before adoption, SAMA approval before use or contract, data located in Saudi Arabia unless SAMA explicitly approves otherwise, logical segregation, audit and review rights, and return and irreversible deletion of data on exit.

• Appendices A to F

A lists the superseded SAMA circulars and the referenced payment, outsourcing and business continuity documents; B and C give the process and form for requesting an update; D and E give the waiver process and form; F is the glossary.

What does it cover?

The framework defines principles and objectives for initiating, implementing, maintaining, monitoring and improving cyber security controls in member organizations, and its controls apply to information assets from electronic and hardcopy information to applications, databases, ATMs, storage devices, premises and networks (section 1.3). It gives direction for member organizations and their subsidiaries, staff, third parties and customers; business continuity sits in the separate SAMA Business Continuity Minimum Requirements, and the non-cyber aspects of physical security and fraud management are outside it. Section 1.4 applies it to all banks, insurance and reinsurance companies, financing companies and credit bureaus operating in Saudi Arabia and to the financial market infrastructure; the Rulebook entry adds payment systems and payment services providers and the regulatory sandbox.

What are its objectives?

Section 1.1 states the objectives of the framework, and sections 1.2 and 2.4 add the security goals and the maturity target behind them:

To create a common approach for addressing cyber security within the member organizations (section 1.1).

To achieve an appropriate maturity level of cyber security controls within the member organizations, which section 2.4 sets at level 3 or higher.

To ensure cyber security risks are properly managed throughout the member organizations (section 1.1).

To protect the confidentiality, integrity and availability of information assets, the general security objectives defined in section 1.2.

To let SAMA periodically assess maturity, evaluate control effectiveness and compare member organizations with one another (section 1.1).

Framework in Context

The framework supersedes the SAMA circulars listed in Appendix A, among them the E-Banking Rules and the multi-factor authentication circular, and it refers onward to the SARIE Information Security Policy and the mada Rules and Standards Technical Book for payment systems (3.3.12), the Rules on outsourcing and the SAMA Business Continuity Framework. Subdomain 3.2.3 requires banks to comply with PCI DSS, the EMV technical standard and the SWIFT Customer Security Controls Framework, and section 1.1 names NIST, ISF, ISO, BASEL and PCI as sources. Section 1.8 requires version control, with the preceding version retired when a new one is published; the Rulebook entry issued under Circular No. 381000091275 of May 24, 2017 is the version in force.

Common Framework Mappings

The SAMA Cyber Security Framework is commonly mapped to the international control sets below, several of which section 1.1 names among its sources, so that a member organization's control considerations and evidence can also answer its group or international assessments.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

CSA CCM v4

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2