The SAMA Cybersecurity Framework (CSF): A Compliance Guide for Saudi Financial Institutions

This article is provided for general informational purposes and does not constitute legal advice. Organizations should confirm their specific obligations directly with the Saudi Central Bank (SAMA) or a licensed compliance advisor.

The SAMA Cybersecurity Framework at a glance: scope, four core domains, the maturity model, and a 2026 compliance roadmap.

Why This Matters Now

Search interest in Saudi Arabia around “SAMA cybersecurity framework,” “SAMA CSF,” and adjacent terms like third-party cyber risk, security policy management, and cybersecurity maturity assessment has been climbing steadily through 2026, yet most of the guidance available online comes from cybersecurity vendors rather than from a compliance-training perspective grounded in what examiners actually check. That gap matters because the SAMA Cybersecurity Framework (SAMA CSF) is not optional guidance — it is the mandatory cybersecurity baseline the Saudi Central Bank enforces across every bank, insurer, finance company, and payment provider it licenses, and non-compliance carries real supervisory consequences.

This guide explains what the SAMA CSF actually requires, how it differs from Saudi Arabia's other major cybersecurity baseline (the National Cybersecurity Authority's Essential Cybersecurity Controls), how SAMA measures compliance maturity, and the practical steps a regulated entity should take to close the gap before its next examination cycle.

What Is the SAMA Cybersecurity Framework?

The SAMA Cybersecurity Framework is the cybersecurity governance and risk baseline issued by the Saudi Central Bank (SAMA) under its Cyber Security Framework, published through the official SAMA Rulebook. Unlike general IT security guidance, the SAMA CSF is a supervisory instrument: SAMA uses it to assess whether a regulated entity's cybersecurity governance, risk management, and technical controls meet the standard required to protect the Kingdom's financial sector from systemic cyber risk.

Source: SAMA Rulebook — Cyber Security Framework (rulebook.sama.gov.sa)

The framework sits alongside — but is distinct from — the National Cybersecurity Authority's Essential Cybersecurity Controls (NCA ECC), which apply more broadly across government and critical national infrastructure sectors. For financial institutions specifically, SAMA's framework is generally the more detailed and sector-specific of the two, and SAMA-regulated entities are expected to meet it in addition to, not instead of, any applicable NCA requirements.

Who Must Comply

Source: SAMA Rulebook — Cyber Security Framework; scope corroborated against independent regulatory-advisory sources.

Inside the Framework: The Core Domains

Advisory sources that summarize the SAMA CSF consistently describe it as organized around four core domains. The framework's own full control catalogue is distributed directly to regulated entities through SAMA's supervisory channels rather than published as an open document, so organizations should always confirm the current control list with SAMA directly or through their compliance officer — but the domain structure below is well established across independent compliance advisories:

• Cybersecurity Leadership and Governance — board-level oversight, a documented cybersecurity strategy, defined roles and responsibilities, and organization-wide awareness and training.

• Cybersecurity Risk Management and Compliance — risk identification and treatment, regulatory compliance tracking, and independent assurance (internal audit or external review) of the cybersecurity program.

• Cybersecurity Operations and Technology — the largest domain in practice, covering identity and access management, application security, infrastructure and network security, cryptography, payment and e-banking system controls, and incident management.

• Third-Party Cybersecurity — due diligence, contractual controls, and ongoing monitoring of vendors, outsourcing arrangements, and cloud service providers that touch the institution's systems or data.

Some advisories also treat cyber resilience and business continuity as an emerging fifth area of focus within the framework's operations domain — a trend consistent with SAMA's broader push on operational resilience across the sector, and one worth building into your program even where it is not yet broken out as a standalone domain.

The four core domains of the SAMA CSF, and SAMA's five-level maturity scale.

For a step-by-step approach to building the governance structure that underpins all four domains, see our guide on how to build a GRC framework step by step.

How SAMA Measures Compliance: The Maturity Model

Rather than a simple pass/fail checklist, SAMA assesses regulated entities against a maturity scale — typically described across advisory sources as running from an initial/ad hoc level up to an optimized/adaptive level. The consistent point across sources is this: SAMA expects regulated entities to reach at least Level 3 (“Defined” or “Structured and Formalized”) across all domains, meaning controls must be documented, consistently applied, and evidenced — not just informally practiced.

Regulated entities are generally expected to complete a self-assessment on an annual cycle, retain supporting evidence, and be prepared for SAMA to validate results through document review, on-site inspection, or independent assessment. Because exact control counts and scoring weightings differ across secondary sources and SAMA does not publish the full catalogue publicly, treat the table above as a directional guide and confirm scoring specifics against your official SAMA correspondence.

SAMA CSF vs. NCA ECC: Which Framework Applies to You?

This is one of the most common points of confusion for compliance teams, and a large share of the search demand behind this article comes from exactly this question.

NCA ECC (Essential Cybersecurity Controls) is the national cybersecurity baseline issued by the National Cybersecurity Authority and applies broadly across government entities and critical national infrastructure sectors. See our explainer on what NCA ECC is and why it matters and how organizations prepare for NCA ECC audits.

SAMA CSF is sector-specific to SAMA-regulated financial institutions and is generally more detailed on payment-system, e-banking, and third-party controls relevant to banking and finance.

In practice, a SAMA-regulated bank or fintech should expect to be assessed against both frameworks where they overlap, with SAMA's framework taking precedence for financial-sector-specific requirements. Building your governance program around the stricter of the two is the safer default.

What Happens If You Don't Comply

SAMA's supervisory toolkit for cybersecurity shortfalls mirrors the enforcement posture it applies across its other regulatory domains — see our coverage of SAMA's 2026 enforcement law and sanctions framework for the broader enforcement context. For cybersecurity specifically, advisory sources consistently describe consequences that can include:

• Formal supervisory findings requiring a remediation plan and timeline

• Enhanced supervision, more frequent reporting, or additional on-site examinations

• In serious or repeated cases, restrictions on licensed activities

Exact penalty structures are not published in detail, so the operating assumption compliance teams should use is that a documented, evidenced Level 3+ program is materially cheaper than the supervisory and reputational cost of falling short during an examination.

Building Your SAMA CSF Compliance Roadmap

1. Confirm your obligation. Verify your entity's exact SAMA licensing category and the specific communications SAMA has sent your compliance function regarding CSF requirements.

2. Map your current state. Run an internal gap assessment against the four domains above, scoring each control area on the 0–5 maturity scale.

3. Prioritize Level 3 gaps first. Focus remediation on any control area currently below the “Defined” level, since that is SAMA's expected floor.

4. Formalize governance. Ensure board-level sign-off, a named accountable owner, and documented policies exist for every domain.

5. Extend due diligence to vendors. Update third-party contracts and monitoring procedures to cover the Third-Party Cybersecurity domain explicitly.

6. Schedule the annual self-assessment. Build evidence collection into business-as-usual operations rather than a once-a-year scramble.

7. Train your team. Structured, role-specific training closes the gap between policy and practice faster than documentation alone.

For a working template covering steps 1 and 4, see our practical SAMA compliance checklist for banks.

Seven steps to move from gap assessment to SAMA CSF audit readiness.

Readiness Checklist

☐ Board-approved cybersecurity strategy and policy set in place

☐ Named executive owner for cybersecurity governance

☐ Current maturity score documented for each of the four domains

☐ Remediation plan in place for any control below Level 3

☐ Third-party / vendor cybersecurity due-diligence process formalized

☐ Annual self-assessment scheduled with evidence-collection owners assigned

☐ Incident management and escalation procedures tested in the last 12 months

Conclusion

The SAMA Cybersecurity Framework is not a document to file away after a single audit cycle — it is an ongoing supervisory expectation that Saudi financial institutions build, evidence, and mature their cybersecurity governance year over year. Institutions that treat CSF alignment as a continuous program, rather than a periodic compliance exercise, are the ones that walk into a SAMA examination with confidence. Our SAMA Cybersecurity Framework (CSF) Compliance course is built specifically around this framework — covering governance, risk management, technical security, operations, and third-party oversight — to take compliance officers and risk teams from framework fundamentals through maturity assessment and audit readiness.