Saudi Arabia — SAMA

SAMA Cyber Security Framework (CSF) Compliance

The Saudi Central Bank (SAMA) Cyber Security Framework is mandatory for banks, insurance companies, finance companies and financial market infrastructure providers licensed in the Kingdom. Cyberox supports SAMA-regulated entities through gap assessment, remediation and annual self-assessment cycles.

Request a SAMA CSF Gap Assessment → Talk to an Expert

Last reviewed: September 2026. Verify current requirements against the official regulator before acting — sources linked below.

Framework domains

Annual

Self-assessment cycle

Maturity-based

Assessment model

Banks · Insurers · FMIs

In scope

Regulatory Landscape

What This Framework Requires

🏦

Who Must Comply

SAMA CSF applies to all entities licensed and supervised by the Saudi Central Bank — commercial and Islamic banks, insurance and reinsurance companies, finance companies, and financial market infrastructure (FMI) providers operating in Saudi Arabia.

📊

Framework Structure

The framework covers cybersecurity leadership and governance, cybersecurity risk management and compliance, cybersecurity operations and technology, and third-party cybersecurity — assessed against defined maturity levels rather than a simple pass/fail checklist.

🔁

Annual Self-Assessment

SAMA-supervised entities are expected to self-assess their cybersecurity maturity against the framework on a recurring basis and report results through SAMA's supervisory channels. Maintaining continuous, audit-ready evidence is central to staying compliant, not a once-a-year scramble.

🤝

Third-Party & Vendor Risk

A dedicated framework domain addresses third-party cybersecurity — increasingly relevant as banks and insurers rely on cloud providers, fintech partners and outsourced technology vendors. Third-party risk assessment is often the fastest-growing gap area we find.

🏆

ISO 27001 & NCA ECC Alignment

SAMA CSF, ISO/IEC 27001, and the NCA's Essential Cybersecurity Controls share overlapping governance and risk-management structures. Financial institutions typically benefit from a single integrated program rather than three parallel compliance tracks.

⚠️

Verify Before You Commit

SAMA periodically updates its supervisory frameworks and guidance. Confirm current framework version, maturity-level definitions and reporting requirements directly with SAMA or your compliance/legal counsel before finalizing any program — this page is a starting reference, not the authoritative source.

How Cyberox Helps

SAMA CSF Gap Assessment & Maturity Uplift

We help SAMA-regulated banks, insurers and finance companies benchmark current maturity, close priority gaps, and build a sustainable self-assessment process.

✓
SAMA CSF Gap Assessment — Assessment against all four framework domains with a scored maturity baseline mapped to SAMA's maturity model.
✓
Remediation Roadmap — A prioritized, resourced roadmap that closes the highest-risk gaps first, sequenced around your risk appetite and budget cycle.
✓
Third-Party Cybersecurity Program — Vendor risk assessment methodology and ongoing monitoring aligned to the framework's third-party domain.
✓
Annual Self-Assessment Support — Recurring assessment cycles with consistent evidence collection so each year's self-assessment builds on the last, instead of starting over.
✓
ISO 27001 & NCA ECC Cross-Mapping — For institutions pursuing multiple frameworks, we build one control set that satisfies SAMA CSF, ISO 27001 and NCA ECC together.

Request a SAMA CSF Gap Assessment

SAMA CSF — 4 Domains

1Cybersecurity Leadership & Governance

2Cybersecurity Risk Management & Compliance

3Cybersecurity Operations & Technology

4Third-Party Cybersecurity

Maturity-Based Model

Entities self-assess against defined maturity levels and report to SAMA on a recurring basis.

FAQs

Saudi Arabia — SAMA Compliance — Common Questions

Who is required to comply with the SAMA Cyber Security Framework?+

The SAMA Cyber Security Framework is mandatory for all entities licensed and supervised by the Saudi Central Bank, including commercial and Islamic banks, insurance and reinsurance companies, finance companies, and financial market infrastructure providers operating in Saudi Arabia.

What does the SAMA Cyber Security Framework assess?+

The framework is organized around four domains — cybersecurity leadership and governance, cybersecurity risk management and compliance, cybersecurity operations and technology, and third-party cybersecurity — assessed against defined maturity levels rather than a binary pass/fail. Confirm the current maturity-level definitions directly with SAMA, as supervisory frameworks are periodically updated.

How often must SAMA-regulated entities self-assess?+

SAMA-supervised institutions are generally expected to conduct cybersecurity self-assessments against the framework on a recurring (typically annual) basis and report results through SAMA's supervisory channels. Cyberox helps build a repeatable process so each cycle builds on documented evidence from the last.

How does SAMA CSF relate to ISO 27001 and NCA ECC?+

All three frameworks share overlapping governance and risk-management foundations. Financial institutions in Saudi Arabia often pursue ISO 27001 certification and NCA ECC alignment alongside SAMA CSF compliance — cross-mapping the control sets into one program is typically more efficient than treating them separately.