What Is SAMA CSF Compliance and Why Do Saudi Financial Institutions Need It?

SAMA CSF compliance means a Saudi financial institution meets the mandatory controls of the SAMA Cyber Security Framework, and it is required because the Saudi Central Bank (SAMA) expects every regulated Member Organization to reach at least Level 3 (Defined) maturity across all 4 domains. SAMA issued the Cyber Security Framework (CSF) in May 2017 under Circular No. 381000091275 to standardize cybersecurity controls across the financial sector. The framework applies to banks, insurance and reinsurance companies, financing companies, credit bureaus, and payment service providers.

Apprise Cyber KSA provides SAMA CSF compliance consultancy through five core services: gap assessment, risk assessment, implementation, audit preparation, and certification support. Each service maps to the framework’s 4 domains: Cyber Security Leadership and Governance, Risk Management and Compliance, Operations and Technology, and Third-Party Cyber Security.

Institutions below the Level 3 baseline carry regulatory exposure during SAMA examinations. Institutions across Riyadh, Jeddah, Dammam, Khobar, and the Eastern Province work with Apprise Cyber KSA to close gaps and maintain continuous compliance.

What Is the SAMA Cyber Security Framework (CSF)?

The SAMA Cyber Security Framework is a cybersecurity governance standard that defines mandatory controls for financial institutions regulated by the Saudi Central Bank. SAMA issued Version 1.0 in May 2017 under Circular No. 381000091275, drawing from ISO 27001, NIST CSF, PCI-DSS, and BASEL III, adapted to the Saudi financial sector.

The SAMA CSF is structured around 4 core domains:

Cyber Security Leadership and Governance : board accountability, CISO independence, and organization-wide cyber strategy
Cyber Security Risk Management and Compliance : risk register maintenance and alignment with regulatory reporting
Cyber Security Operations and Technology : technical controls, access management, monitoring, and data protection
Third-Party Cyber Security : vendor risk assessment and contractual security requirements

These 4 domains break down into 32 subdomains and approximately 118 control considerations. SAMA evaluates compliance using a 6-level maturity model, ranging from Level 0 (Non-existent) to Level 5 (Adaptive). Member organizations must achieve a minimum of Level 3 (Defined) across all 4 domains.

Who Must Comply With SAMA CSF in Saudi Arabia?

SAMA CSF compliance applies to all Member Organizations regulated and supervised by the Saudi Central Bank, including banks, insurance companies, financing companies, credit bureaus, payment service providers, and financial market infrastructure operators. The framework covers 5 primary entity categories:

Banks : commercial and investment banks operating within Saudi Arabia
Insurance and Reinsurance Companies : health, travel, auto, and liability insurance providers
Financing Companies : micro lending, leasing, and consumer finance providers
Credit Bureaus : organizations handling credit histories and credit scores
Payment Service Providers : fintech companies, mobile wallet providers, and e-commerce payment gateways

Compliance obligations extend to third-party vendors and technology providers serving SAMA-regulated institutions, since Domain 4 holds member organizations accountable for vendor risk. Institutions across Riyadh, Jeddah, Dammam, Khobar, and the Eastern Province fall under this scope if they hold a SAMA license or process financial data on behalf of a licensed entity.

What Does a SAMA CSF Compliance Consultancy Service Include?

A SAMA CSF compliance consultancy service delivers 5 core services. Apprise Cyber structures these around SAMA’s 4-domain framework so every deliverable maps directly to the subdomains and control considerations SAMA examiners assess:

SAMA CSF Gap Assessment : evaluates current posture against all 32 subdomains relative to the Level 3 baseline
Cyber Risk Assessment : analyzes threats and vulnerabilities across systems, data, and third-party relationships
SAMA CSF Implementation : builds and deploys the policies, procedures, and technical controls required to close gaps
Audit Preparation : organizes evidence and documentation ahead of SAMA examinations or independent audits
Certification Support : supports ongoing maturity validation and regulatory reporting

Apprise Cyber’s SAMA CSF consultants also provide governance support, including cyber security committee structuring and board-level reporting templates required under Domain 1.

How Does a SAMA CSF Gap Assessment Work?

A SAMA CSF Gap Assessment evaluates current controls against the framework’s 4 domains and 32 subdomains to identify shortfalls against the Level 3 baseline. Apprise Cyber conducts this assessment before implementation begins, since it defines scope, priority, and timeline for the entire program. The process follows 5 sequential steps:

Scope Definition : identify systems, business units, and third-party relationships within the assessment boundary
Control Evaluation : review existing policies, procedures, and technical controls against applicable subdomains
Maturity Scoring : rate each control on SAMA’s 6-level maturity model
Gap Identification : document deficiencies against the required Level 3 baseline
Roadmap Development : translate gaps into a prioritized remediation plan with timelines

How Is SAMA CSF Implemented Step by Step?

SAMA CSF implementation converts the gap assessment roadmap into deployed policies, procedures, and technical controls across all 4 domains. Apprise Cyber structures implementation around the specific gaps identified in the assessment phase. The roadmap follows 6 stages:

Governance Setup : establish the cyber security committee and assign CISO accountability under Domain 1
Policy and Procedure Development : draft required security policies, standards, and procedures
Technical Controls Deployment : implement access management, monitoring, and data protection under Domain 3
Third-Party Risk Controls : establish vendor assessment and contractual requirements under Domain 4
Remediation : close identified control gaps, prioritized by risk severity
Validation : test controls against the maturity model to confirm Level 3 or higher

Governance requires ongoing maintenance after implementation. The cyber security committee must continue reviewing control effectiveness and reporting to the board on a defined cadence, since compliance is assessed as a continuous maturity state rather than a one-time certification.

What Security Controls Are Required Under SAMA CSF?

SAMA CSF security controls span identity and access management, incident response, business continuity, disaster recovery, security monitoring, and threat management. These sit primarily within Domain 3. SAMA CSF requires 6 core control categories:

Identity and Access Management : user provisioning, privileged access controls, and authentication standards
Incident Response : procedures for detecting, containing, and reporting incidents to SAMA
Business Continuity : plans that maintain critical operations during and after a disruptive event
Disaster Recovery : technical recovery procedures for restoring systems and data
Security Monitoring : continuous logging and detection across networks, applications, and endpoints
Threat Management : identifying, assessing, and mitigating emerging cyber threats

Institutions must also maintain vulnerability management controls, connecting directly to Domain 4’s third-party risk controls, since vendor systems fall within the same scope.

How Does a SAMA CSF Compliance Audit Differ From an Internal Audit?

A SAMA CSF compliance audit verifies cybersecurity maturity against SAMA’s regulatory requirements, while an internal audit is one component of that structure. SAMA CSF operates on a three-lines-of-defense model: business units manage risk, risk and compliance teams provide oversight, and internal audit independently verifies control effectiveness. The two differ across 4 dimensions:

Scope : a compliance audit evaluates all 4 domains; internal audit may cover broader organizational risk
Authority : compliance audits report to the Board Audit Committee; internal audit is the third line of defense
Frequency : an annual internal audit report is required, alongside periodic SAMA inspection visits
Outcome : compliance audit findings affect regulatory standing; internal audit findings feed risk management

Customer-facing and internet-facing services carry additional requirements, including annual review and penetration testing separate from the broader audit cycle.

Why Choose Apprise Cyber KSA for SAMA CSF Compliance in Saudi Arabia?

Apprise Cyber KSA is the right choice for SAMA CSF compliance because every deliverable maps to the framework’s 4 domains, 32 subdomains, and the Level 3 maturity baseline that SAMA examiners assess. The SAMA Cyber Security Framework (CSF) requires documented evidence, not stated intent. Apprise Cyber KSA delivers five services: gap assessment, risk assessment, implementation, audit preparation, and certification support. Each policy, procedure, and control document links to a specific subdomain. Apprise Cyber KSA also supports Domain 1 governance, including cyber security committee structuring and board-level reporting templates.

Apprise Cyber KSA works alongside internal teams, because sustainable SAMA CSF compliance requires internal ownership after implementation. The consultancy supports banks, insurance companies, financing companies, credit bureaus, and payment service providers across Riyadh, Jeddah, Dammam, Khobar, and the Eastern Province. Engagements start with a gap assessment against the Level 3 baseline, then move through implementation and audit preparation. Ongoing advisory support continues as the framework evolves.

What Are the Frequently Asked Questions

What is the SAMA Cyber Security Framework (CSF)?

The SAMA Cyber Security Framework is a mandatory cybersecurity governance standard issued by the Saudi Central Bank for regulated financial institutions. SAMA issued it in May 2017 under Circular No. 381000091275. It draws from ISO 27001, NIST CSF, PCI-DSS, and BASEL III, adapted to the Saudi financial sector.

Who must comply with SAMA CSF in Saudi Arabia

All Member Organizations regulated and supervised by the Saudi Central Bank must comply. This includes banks, insurance and reinsurance companies, financing companies, credit bureaus, and payment service providers. Third-party vendors serving these institutions are also affected through Domain 4.

What are the 4 domains of SAMA CSF?

SAMA CSF has 4 domains: Cyber Security Leadership and Governance, Cyber Security Risk Management and Compliance, Cyber Security Operations and Technology, and Third-Party Cyber Security. These break down into 32 subdomains and approximately 118 control considerations.

What maturity level does SAMA CSF require?

SAMA requires a minimum of Level 3 (Defined) across all 4 domains. SAMA evaluates compliance on a 6-level maturity model, from Level 0 (Non-existent) to Level 5 (Adaptive).

What does a SAMA CSF compliance consultancy service include?

A SAMA CSF consultancy delivers five core services: gap assessment, risk assessment, implementation, audit preparation, and certification support. Apprise Cyber KSA maps each deliverable to the framework’s subdomains and control considerations that SAMA examiners assess.

How does a SAMA CSF gap assessment work?

A SAMA CSF gap assessment evaluates current controls against all 4 domains and 32 subdomains to identify shortfalls against the Level 3 baseline. The process has 5 steps: scope definition, control evaluation, maturity scoring, gap identification, and roadmap development.

What is the difference between a gap assessment and a readiness assessment?

A gap assessment evaluates control design, while a readiness assessment verifies evidence. The gap assessment identifies where controls fall short of Level 3. The readiness assessment confirms that documentation and audit trails meet SAMA’s evidentiary standards before an examination or audit.

What security controls does SAMA CSF require?

SAMA CSF requires six core control categories: identity and access management, incident response, business continuity, disaster recovery, security monitoring, and threat management. These sit primarily within Domain 3. Institutions must also maintain vulnerability management controls that extend to third-party systems.

Why hire a SAMA CSF consultant instead of managing compliance in-house?

Consultants close gaps that in-house teams typically cannot address alone. These include current knowledge of SAMA CSF requirements, documentation structured to SAMA’s evidentiary standard, faster compliance timelines, and ongoing governance support. Apprise Cyber KSA works alongside internal teams, since sustainable compliance needs internal ownership.

How do you start SAMA CSF compliance with Apprise Cyber KSA?

Start with an initial consultation, followed by a scoping call and a readiness assessment booking. The consultation reviews your current posture and timeline. The scoping call defines systems, business units, and third-party relationships. The assessment then sets your baseline maturity score and roadmap.

Apprise Cyber Provides

Connect To

Apprise Cyber

Contact Us Now

Our Support Team Is Ready to Assist You!

Get Directions