Skip to content
Emergency helpGet started
Compliance & Governance

What is the SAMA Cyber Security Framework?

The SAMA Cyber Security Framework sets four domains and a maturity model for Saudi banks, insurers and finance companies. Scope, domains and evidence.
By VigilbasePublished
Read the guideMore Topics

The SAMA Cyber Security Framework (CSF) is the Saudi Central Bank's cyber security framework for the financial institutions it regulates. Version 1.0 was issued in May 2017 and is listed as in force in the SAMA Rulebook. It applies to SAMA's Member Organizations, including banks, insurance and reinsurance companies, financing companies, credit bureaus, and the financial market infrastructure. The framework has four domains and a six-level maturity model, and Member Organizations should operate at maturity level 3 or higher.

Who issued the SAMA CSF and when?

The Saudi Arabian Monetary Authority issued the framework as Version 1.0 in May 2017. The SAMA Rulebook records it as number 381000091275, dated 24/5/2017 (28/8/1438H), with the status in force. The authority is now the Saudi Central Bank, which keeps the SAMA abbreviation. As the owner of the framework, it is solely responsible for interpreting its principles, objectives, and control considerations.

Who must comply with the SAMA CSF?

The framework applies to all Member Organizations regulated by SAMA. All domains apply to the banking sector. Other financial institutions are exempt from the subdomains on (inter)national industry standards, payment systems, and electronic banking services. Even so, they should implement the PCI standard or the SWIFT Customer Security Controls Framework if they handle cardholder data or SWIFT services, and multi-factor authentication if they provide online services to customers.
1.All banks operating in Saudi Arabia.
2.All insurance and reinsurance companies operating in Saudi Arabia.
3.All financing companies operating in Saudi Arabia.
4.All credit bureaus operating in Saudi Arabia.
5.The financial market infrastructure.

What are the four SAMA CSF domains?

Each domain is split into subdomains, and each subdomain sets a principle, an objective, and control considerations.
1.Cyber Security Leadership and Governance: governance, strategy, policy, roles and responsibilities, project management, awareness, and training.
2.Cyber Security Risk Management and Compliance: risk management, regulatory compliance, compliance with international standards, review, and audits.
3.Cyber Security Operations and Technology: human resources, physical security, asset management, architecture, identity and access management, application security, change management, infrastructure security, cryptography, BYOD, secure disposal, payment systems, electronic banking, event management, incident management, threat management, and vulnerability management.
4.Third Party Cyber Security: contract and vendor management, outsourcing, and cloud computing.

How does the SAMA maturity model work?

The framework measures each control area on six maturity levels: 0 Non-existent, 1 Ad-hoc, 2 Repeatable but informal, 3 Structured and formalized, 4 Managed and measurable, and 5 Adaptive. Member Organizations should operate at maturity level 3 or higher. At level 3, controls are defined, approved, and implemented in a structured and formalized way, their implementation can be demonstrated, and key performance indicators are monitored and reported. To reach level 3, 4, or 5, an organization must first meet all criteria of the preceding levels.

What does the SAMA CSF say about monitoring, third parties, and cloud?

Several control considerations decide how security operations and suppliers are set up.
1.Event management (3.3.14): a designated security monitoring team, a Security Operations Center, with resources for continuous 24x7 security event monitoring, adequately protected logs, and automated, centralized log analysis and correlation through a SIEM.
2.Incident management (3.3.15): inform SAMA IT Risk Supervision immediately when a medium or high classified security incident occurs, and submit a formal incident report after resuming operations.
3.Infrastructure security (3.3.8): DDoS protection where applicable, including scrubbing services, 24x7 monitoring, and DDoS scrubbing tests at least twice a year.
4.Outsourcing (3.4.2): SAMA approval before material outsourcing.
5.Cloud computing (3.4.3): SAMA approval before using hybrid or public cloud services or signing with a cloud provider, and in principle only cloud services located in Saudi Arabia, unless SAMA gives explicit approval for services outside the Kingdom.

How is the SAMA CSF assessed?

Implementation is subject to periodic self-assessment based on a questionnaire, and SAMA reviews and audits the self-assessments to determine compliance and the maturity level. Where a control cannot be implemented, the framework expects compensating controls, an internal risk acceptance, and a formal waiver request to SAMA. SAMA's circular to banks also asked for quarterly reports and said SAMA would conduct periodic inspection visits to verify the assessments. The framework itself contains no penalty clause.

Where does Vigilbase help with SAMA CSF evidence?

Vigilbase supplies operating evidence, not a maturity rating. Vigilbase OS connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place, with dashboards for each team; each investigation records the evidence, action, and verification, which helps you evidence event and incident management. Vigilbase's managed SOC runs on that record, with around-the-clock coverage on the Priority and Critical SLA tiers. Managed Cloudflare operates DDoS and WAF controls in scope; agree how the twice-yearly DDoS test will be run and recorded. Using any outside service may need SAMA approval under the outsourcing and cloud subdomains, so confirm that with SAMA before onboarding.

About this guide

This guide summarizes the SAMA Cyber Security Framework, Version 1.0, as published in the SAMA Rulebook in October 2026. It is not legal advice. Some related circulars state that the Arabic text governs. Confirm current requirements with SAMA and your legal and compliance owners.

Key Takeaways

✓The SAMA CSF applies to banks, insurers, financing companies, credit bureaus, and the financial market infrastructure regulated by SAMA.
✓It has four domains and six maturity levels, and Member Organizations should operate at level 3 or higher.
✓It expects a SOC with 24x7 monitoring, a SIEM, and immediate reporting of medium and high incidents to SAMA.
✓Material outsourcing and public or hybrid cloud services need SAMA approval.

Sources

Related Solutions

Vigilbase services related to this guide

Managed SOC

Learn more

Managed Cloudflare

Learn more

Get started with Vigilbase OS

Learn more

Cybersecurity in Saudi Arabia

Learn more

Frequently Asked Questions

Is the SAMA Cyber Security Framework mandatory?

Yes, for the Member Organizations regulated by SAMA. The framework is mandated by SAMA, Member Organizations are responsible for adopting and implementing it, and SAMA reviews and audits their periodic self-assessments.

What maturity level does SAMA require?

Member Organizations should operate at maturity level 3, Structured and formalized, or higher, on a scale from 0 to 5.

Does the SAMA CSF require a SOC?

The event management subdomain expects a designated security monitoring team, a Security Operations Center, with resources for continuous 24x7 monitoring and centralized log analysis through a SIEM.A managed SOC can provide part of that capability. With Vigilbase, around-the-clock coverage applies on the Priority and Critical SLA tiers. Confirm any outsourcing approval with SAMA first.Security operations responsibilitiesCoverage and incident response commitments

Can a Saudi bank use cloud services outside Saudi Arabia?

Only with explicit approval from SAMA. In principle the framework expects cloud services located in Saudi Arabia, and SAMA approval is needed before using hybrid or public cloud services or signing with a cloud provider.

How does the SAMA CSF relate to the NCA ECC?

The SAMA CSF is a sector framework for the financial institutions SAMA regulates. The NCA's ECC is the national baseline for government entities and operators of Critical National Infrastructures. An institution can fall under both, so check each regulator's scope for your entity.

Related Topics

Security Basics

What is SIEM?

Security Basics

What is SOC?

Compliance & Governance

NCA ECC

Compliance & Governance

Saudi PDPL

Get Started

Ready to Improve Your Security?

Our team can help you implement the security measures discussed in this guide. Get expert guidance tailored to your organization.
Get started Continue Learning