SAMA CSF: Complete Guide to the SAMA Cybersecurity Framework

Compliance with a cybersecurity framework is more than having policies and security tools in place. Financial institutions also need to know whether controls are applied consistently, monitored adequately, and effective against the risks they address.

This is where the SAMA CSF comes in. The SAMA Cybersecurity Framework provides organizations regulated by the Saudi Central Bank with a structured approach to managing cyber risk, implementing controls, measuring maturity, and enhancing their security. Rather than simply asking whether a control exists, it considers how the control works in practice. Falling short isn’t just a failed assessment; it leaves the underlying risk unmanaged and brings regulatory scrutiny and remediation timelines with it.

SAMA CSF at a Glance

What Is SAMA CSF?

The SAMA CSF, also known as the Saudi Central Bank Cyber Security Framework or SAMA Cyber Security Framework, is the cybersecurity framework established by the Saudi Central Bank for regulated Member Organizations.

It aims to establish a common cybersecurity approach, enhance cybersecurity maturity, and ensure proper management of cybersecurity risks. It is a principle-based approach, allowing organizations to apply its requirements in line with their context and risk profile.

To Whom Does the SAMA Framework Apply?

The framework applies to Member Organizations regulated by SAMA, including banking, insurance and reinsurance, financing, credit bureaus, financial market infrastructure, and others. Specific requirements may vary depending on the organization’s regulatory scope.

Cybersecurity is not only an IT responsibility. An organization’s security posture can be affected by leadership, employees, business functions, technology teams, and third parties.

The Four Domains of SAMA CSF

The framework consists of four domains covering leadership and governance, risk management and compliance, operations and technology, and third-party security. These four domains break down further into 32 subdomains, each with its own specific control objectives.

1. Cyber Security Leadership and Governance

This domain relates to cybersecurity strategy, policy, responsibility, oversight, and accountability. Good governance ensures that cybersecurity risks are presented to the necessary decision-makers and that security priorities have clear ownership.

2. Cyber Security Risk Management and Compliance

Organizations need to identify, assess, manage, and monitor cybersecurity risks by understanding key assets, threats, existing controls, and gaps.

Particular attention is given to connecting documentation with implementation:

• Policy: What should be done
• Procedure: How it should be done
• Monitoring: How the organization knows it is being done
• Evidence: What proves it is being done

3. Cybersecurity Operations and Technology

This area relates to the technical and operational capabilities used to protect information assets and services. Depending on the requirements, this can range from access management and vulnerability management to security monitoring, incident management, and security architecture.

4. Third-Party Cyber Security

Vendors and service providers with access to business processes, systems, and data can pose risks. Organizations should understand these risks, set appropriate security requirements, and monitor third-party security throughout the relationship.

SAMA CSF Maturity Levels Explained

The maturity model illustrates the evolution of cybersecurity practices, from informal to measurable, continuously improving controls. It comprises six levels, ranging from Level 0 to Level 5, with SAMA stating that Member Organizations should operate at Level 3 or higher. A small number of subdomains, such as security operations center capabilities and event management, are expected to reach Level 4.

Why Level 3 Matters

Level 3 is a level that organizations should understand clearly. Controls need to be defined, approved, and implemented through appropriate processes, with compliance monitored.

For instance, an access-control policy alone is not a strong indicator of effective access management. Defined procedures, ownership, access reviews, monitoring, and supporting evidence are also required.

How to Prepare for SAMA CSF Compliance

There are five practical steps organizations can follow:

1. Take stock: Identify applicable requirements and compare them with existing controls, policies, procedures, technologies, evidence, and responsibilities.
2. Prioritize gaps: Consider asset criticality, business impact, threat exposure, regulatory importance, and existing safeguards when deciding which gaps to address first.
3. Set ownership: Make sure major controls and remediation activities have clearly defined owners.
4. Keep evidence: Integrate approvals, testing results, monitoring information, access reviews, logs, and assessments into normal security operations.
5. Assess effectiveness: Evaluate whether controls are working as intended and use the results to improve the program.

The Human Layer of Cybersecurity

That same policy-procedure-monitoring-evidence chain applies to people, not just systems, and it is often hardest to hold together here. Strong technical controls still depend on people. Employees interact with email, credentials, applications, customer information, and business systems every day. These interactions can be targeted through phishing, impersonation, and social engineering attacks.

Employee security is therefore critical to overall cybersecurity maturity. Training completion alone does not indicate whether employees can detect and respond to threats. Organizations also need to understand risky behavior and determine whether their awareness efforts are effective.

Where Threatcop Fits

Threatcop’s People Security Management approach focuses on this human layer through simulated attacks, employee risk assessment, training, security awareness, and reporting.

The AAPE process, Assess, Aware, Protect, and Empower, supports an ongoing approach to security awareness. Organizations can assess employee risk, test responses to realistic scenarios, provide targeted awareness, and track progress.

What Should a Good SAMA CSF Program Achieve?

An established program should provide security leaders with a clear understanding of their cybersecurity environment. They should know the applicable requirements, their current maturity level, critical gaps, gap owners, evidence of implementation, and whether controls, including the people who operate them, are working effectively.

The best programs bring together governance, risk, technology, controls, evidence, people, and continuous improvement. This turns compliance into a long-term security practice instead of merely an annual evaluation.

Final Thoughts

The SAMA CSF provides regulated financial institutions with a framework for managing cyber risk, implementing controls, measuring maturity, and enhancing their security posture.

Passing an assessment should not be the only goal. The objective should be to develop a cybersecurity program that can demonstrate what it protects, how its controls operate, whether they are effective, and what it needs to improve next.

If your program can show policies and tools but not evidence that they are working, particularly on the human side, that is the gap to prioritize. Talk to Threatcop about running an AAPE assessment against your current SAMA CSF maturity baseline.

FAQs

Threatcop