Approved documents
Policies, standards and procedures for each subdomain, approved at the right level, with version history and a review date that is still current.
Compliance service
Assess and implement SAMA CSF controls.
Limaz assesses readiness, maps applicable controls, designs remediation, supports implementation, builds the evidence model, and validates progress for SAMA-supervised organizations.
What Limaz delivers
- SAMA CSF readiness and gap assessment
- Control applicability, ownership, and target-state mapping
- Risk-prioritized implementation and remediation roadmap
- Hands-on process and technical control implementation
- Evidence model, validation, and progress reporting
What the SAMA Cyber Security Framework is
The SAMA Cyber Security Framework sets cybersecurity expectations for institutions supervised by the Saudi Central Bank. Implementation requires a target control set, named owners, technical and process changes, and current evidence for review.
How Limaz implements SAMA CSF
Scope the requirement
Establish which controls apply to your licence and activities, and which systems and owners they land on.
Map the current state
Review the policies, systems, owners, evidence, and gaps that exist today.
Design the target
Control architecture, decision rights, and what must change in process and technology.
Sequence the work
Create an implementation backlog with owners, dependencies, priorities, and acceptance criteria.
Connect evidence
Logs, approvals, tests, and artefacts tied to owners so reviews do not start from zero.
Validate and remediate
Prove operation, then close residual risk as measurable work.
Common implementation gaps
- Policies exist without implemented technical or process controls.
- Owners are named in documents but not in operating routines.
- Evidence is assembled for a review week, then decays.
- Remediation lists are not sequenced as engineering work.
- Third-party access sits outside the control model.
- Fraud and AML tooling is disconnected from the cybersecurity control set.
The four domains
- 3.1 Cyber Security Leadership and Governance
- Seven subdomains: governance, strategy, policy, roles and responsibilities, cyber security in project management, awareness, and training. Here SAMA looks for accountability at board level, a cyber security committee, and a Chief Information Security Officer (CISO) who leads a function independent of IT.
- 3.2 Cyber Security Risk Management and Compliance
- Five subdomains: cyber security risk management, regulatory compliance, compliance with (inter)national industry standards, cyber security review, and cyber security audits. Risk becomes a managed register with owners, and compliance becomes something you test on a schedule.
- 3.3 Cyber Security Operations and Technology
- Seventeen subdomains: human resources, physical security, asset management, cyber security architecture, identity and access management (IAM), application security, change management, infrastructure security, cryptography, bring your own device (BYOD), secure disposal of information assets, payment systems, electronic banking services, event management, incident management, threat management, and vulnerability management. Most of the engineering work lands here.
- 3.4 Third Party Cyber Security
- Three subdomains: contract and vendor management, outsourcing, and cloud computing. Under 3.4.3, an institution obtains SAMA approval before it uses public or hybrid cloud services or signs the cloud contract.
- How each subdomain is written
- Every subdomain states a principle, an objective and control considerations. The framework is principle-based: it defines the outcome SAMA expects and leaves the technical design to you. Two banks can meet the same subdomain with different tools, so evidence carries more weight than product names.
Maturity levels, and what level 3 actually requires
The CSF, version 1.0 issued in May 2017, scores each subdomain on a six-level maturity model from 0 to 5. SAMA expects member organisations to operate at level 3 or higher, and each level includes every level below it. SAMA has also published separate Maturity Level 4 Requirements in the SAMA Rulebook, so level 3 is the floor, not the finish line.
Level 0: Non-existent
No documentation and no awareness of the control. The control is not in place.
Level 1: Ad-hoc
The control is undefined or only partly defined. Execution depends on individuals and differs between departments.
Level 2: Repeatable but informal
The control runs the same way each time, but the practice is unwritten. It works only while the same people stay in their roles.
Level 3: Structured and formalised
Controls are defined, approved and implemented in a structured, formal way, and you can demonstrate it. Policies, standards and procedures are written and approved. Compliance with them is monitored, preferably in a governance, risk and compliance (GRC) tool. Key performance indicators (KPIs) are defined, monitored and reported. In practice: every subdomain has an approved document, a named owner, a running control, and a KPI with recent results.
Level 4: Managed and measurable
Control effectiveness is measured and reviewed on a fixed cycle. Key risk indicators (KRIs) and trend reports show which controls are improving and which are slipping.
Level 5: Adaptive
Controls improve continuously through a documented improvement plan that is integrated with enterprise risk management.
The self-assessment and what SAMA reviewers ask for
Every institution runs a periodic self-assessment of its CSF implementation. It completes the assessment using a SAMA questionnaire, and SAMA reviews and audits the results to set the compliance level and maturity level. SAMA issues no CSF certificate, so your rating rests on the evidence behind each answer. This is the evidence a strong submission carries.
Governance records
Board and cyber security committee minutes, the approved cyber security strategy, the CISO appointment, and the reporting line that keeps cyber security independent of IT.
Proof of operation
Samples that show controls running: access reviews, change tickets, vulnerability scan results with fix dates, incident records, and backup restore tests.
KPIs with results
Indicators for each subdomain, with recent measured values and the forum that reviewed them. A KPI with no data is a level 2 answer.
Risk and exceptions
The cyber security risk register, treatment plans, and approved exceptions with owners and expiry dates.
Third-party and cloud files
Contracts with security clauses, vendor assessments, outsourcing records, and SAMA approvals for cloud services.
Common gaps in banks and fintechs
- The cyber security function reports into IT, so the independence the CSF expects is missing.
- The cyber security committee exists on paper but meets irregularly and tracks no decisions.
- Policies are approved, but the standards and procedures beneath them are missing, so level 3 cannot be shown.
- KPIs cover a few subdomains and are absent from the rest.
- Cloud services went live, or contracts were signed, before SAMA approval arrived.
- Security joins projects at the end, which leaves subdomain 3.1.5 (cyber security in project management) unmet.
- Awareness campaigns run, but role-based training for IT staff, developers and privileged users is missing.
- The asset inventory is incomplete, so vulnerability and patch coverage cannot be proven.
- Disposal of laptops, disks and paper records leaves no evidence trail.
- Fintechs built controls to the Cyber Resilience Fundamental Requirements at licensing and never scaled them to the full CSF.
SAMA CSF vs NCA ECC
- Issuer
- The SAMA CSF comes from the Saudi Central Bank (SAMA). The Essential Cybersecurity Controls (ECC) come from the National Cybersecurity Authority (NCA).
- Who it applies to
- SAMA CSF: SAMA member organisations. The framework names banks, insurance and reinsurance companies, finance companies, credit bureaus and financial market infrastructure. Insurance supervision has since moved to the Insurance Authority. NCA ECC: government entities and their companies, plus private entities that own, operate or host critical national infrastructure.
- Current version
- SAMA CSF version 1.0, issued in May 2017, is the text in force. ECC-2:2024 replaced ECC-1:2018.
- Structure
- SAMA CSF: 4 domains and 32 subdomains, each with a principle, objective and control considerations. ECC-2:2024: 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols.
- How compliance is measured
- SAMA CSF rates maturity from 0 to 5 per subdomain, with level 3 as the minimum. ECC is assessed control by control against its stated requirements.
- Third parties and cloud
- SAMA CSF covers vendors, outsourcing and cloud in domain 3.4, including SAMA approval for cloud use. ECC covers them in its fourth domain, and NCA's Cloud Cybersecurity Controls (CCC) extend it for cloud.
- Running both
- Institutions under both keep one control library mapped to each framework, one evidence set, and two reporting views. Most evidence serves both, because the frameworks overlap in governance, risk, access, operations and third parties.
A remediation programme
The sequence that takes an institution to level 3 across all 32 subdomains, and keeps it there.
Score every subdomain
Rate the current maturity of all 32 subdomains against the level definitions, using evidence as well as interviews. The output is a heat map of everything below level 3.
Fix governance first
Set up the cyber security committee, confirm the CISO appointment, and give the cyber security function its own reporting line. Every other subdomain depends on these decisions.
Complete the document hierarchy
Write or repair the policies, standards and procedures for each subdomain, get them approved, and map each document to the subdomain it satisfies.
Implement the controls
Close the technical gaps in identity and access, logging and event monitoring, vulnerability management, cryptography and application security. Run each gap as engineering work with an owner and acceptance criteria.
Bring third parties and cloud into the model
Add security clauses to contracts, assess critical vendors, register outsourcing arrangements, and obtain SAMA approval for cloud services before go-live.
Measure with KPIs
Define KPIs per subdomain, feed them from live systems, and track them in a GRC tool. This step turns an implemented control into a level 3 control.
Rehearse the self-assessment
Answer the SAMA questionnaire internally, attach evidence to every answer, and have an independent reviewer challenge it before SAMA does.
Plan for level 4
Add KRIs and trend reporting so control effectiveness is measured, and use SAMA's published Maturity Level 4 Requirements to set the order.
How it connects to fraud and third-party risk
The CSF sits inside a set of related SAMA requirements, and a mature programme runs them as one control system.
Third-party risk starts in domain 3.4 of the CSF and continues in SAMA's Rules on Outsourcing, issued in December 2019 for banks, with separate outsourcing rules for finance companies. Continuity is governed by the Business Continuity Management (BCM) Framework from February 2017. New entrants start with the Cyber Resilience Fundamental Requirements (CRFR), published in January 2022 for entities joining SAMA's Regulatory Sandbox or applying for a licence.
Fraud is the other side of the same risk. SAMA's Counter-Fraud Framework, version 1.0 from October 2022, applies to the banking sector and is built on governance, prevention, detection and response. Account takeover, social engineering and payment fraud exploit the same identity, access and monitoring weaknesses the CSF targets, so the controls and the evidence overlap.
Naiza, Limaz's fraud and AML decisioning platform, carries the fraud side. It brings identity and document signals, device and behavioural intelligence, transaction monitoring and AML screening into one decision layer, and keeps each rule result, reviewer action and case record on the same path. Fraud teams get a decision at onboarding or payment time, and auditors get a traceable record. Limaz then connects that layer to your CSF control model, so fraud, cyber and third-party controls report through one evidence set.
Further reading
SAMA CSF for fintechs: what to build in your first year
A newly licensed fintech cannot implement 32 subdomains at once. This is the order we would build them in, and the evidence that proves each one works.
SAMA CSF vs NCA ECC: which applies to you, and how to run both
Many Saudi financial institutions answer to both frameworks. The fastest route is one control library with two mappings, not two parallel programmes.
The SAMA CSF self-assessment: how to score maturity level 3 and prove it
SAMA reviews and audits your self-assessment. A score the evidence does not support costs more than an honest gap. Here is how to score each subdomain properly.
Related Limaz pages
Cybersecurity and regulatory engineering
The delivery program behind SAMA and NCA control implementation.
NCA ECC & CCC implementation
When national cybersecurity controls also apply.
Naiza by Limaz
Fraud and AML decisioning for financial institutions.
Security control implementation
Technical controls that make the framework operable.
Questions
The Saudi Central Bank publishes the SAMA Cyber Security Framework for supervised financial institutions.
Map the current control state, define the target architecture and owners, sequence the implementation backlog, connect evidence sources, then validate and remediate. Limaz delivers the implementation work.
Applicability depends on SAMA supervision, licence, and activities.
SAMA CSF applies to SAMA-supervised financial institutions. NCA Essential Cybersecurity Controls apply to covered national entities as defined by NCA. Some organizations must operate both.
The SAMA CSF has four domains: Cyber Security Leadership and Governance (7 subdomains), Cyber Security Risk Management and Compliance (5), Cyber Security Operations and Technology (17), and Third Party Cyber Security (3). That makes 32 subdomains in total. Each subdomain sets a principle, an objective and control considerations, and each is scored separately on SAMA's maturity model.
SAMA expects member organisations to operate at maturity level 3, structured and formalised, or higher, on a scale from 0 to 5. Level 3 means controls are defined, approved and implemented, policies and procedures are documented, compliance is monitored, and key performance indicators are reported. SAMA has also published separate Maturity Level 4 Requirements in the SAMA Rulebook.
Each institution completes a periodic self-assessment using a SAMA questionnaire and scores its maturity for every subdomain. SAMA then reviews and audits the self-assessment to confirm the compliance level and the maturity level. Back every answer with evidence: an approved document, a control record, a KPI result or committee minutes. An answer without evidence is one SAMA's audit cannot confirm.
No. SAMA runs no certification scheme for the Cyber Security Framework, and no external auditor issues a SAMA CSF certificate. Compliance is established through the institution's periodic self-assessment, which SAMA reviews and audits. Independent assessments and ISO 27001 certification help you prepare evidence, but the maturity rating that counts is the one SAMA confirms.
Yes. Subdomain 3.4.3 of the SAMA CSF requires a member organisation to obtain SAMA approval before using public or hybrid cloud services or signing the cloud contract. In principle, cloud services are hosted in Saudi Arabia, and hosting outside the Kingdom needs SAMA's explicit approval. Build the approval into the project plan, ahead of contract signature.
Yes. The framework requires a Chief Information Security Officer (CISO), a senior manager who leads the cyber security function and owns the strategy, policy, architecture and risk assessments. The cyber security function is separate from IT with its own reporting line, and a cyber security committee mandated by the board oversees the programme. Reviewers check the appointment, the reporting line and the committee minutes.
The Cyber Resilience Fundamental Requirements (CRFR), published by SAMA in January 2022, are a prioritised set of baseline controls for entities entering SAMA's Regulatory Sandbox or applying for a licence. The CSF is the full framework, with 32 subdomains and a maturity model. The CRFR is the starting point, and a licensed institution builds from it to the full CSF.
They are separate SAMA frameworks that share many controls. The CSF protects systems and data. The Counter-Fraud Framework, version 1.0 from October 2022, covers fraud governance, prevention, detection and response in the banking sector. Identity, access, monitoring and incident handling serve both, so a shared control library removes duplicate work. Naiza by Limaz covers the fraud detection and decisioning layer.
Discuss your requirements with Limaz
Tell us which system, control, or requirement you are working on. We’ll come back with a clear next step.