Cybersecurity and regulatory engineering
The delivery program behind SAMA and NCA control implementation.
Cybersecurity and regulatory engineeringCompliance service
Assess and implement SAMA CSF controls.
Limaz assesses readiness, maps applicable controls, designs remediation, supports implementation, builds the evidence model, and validates progress for SAMA-supervised organizations.
What Limaz delivers
- SAMA CSF readiness and gap assessment
- Control applicability, ownership, and target-state mapping
- Risk-prioritized implementation and remediation roadmap
- Hands-on process and technical control implementation
- Evidence model, validation, and progress reporting
What the SAMA Cyber Security Framework is
The SAMA Cyber Security Framework sets cybersecurity expectations for institutions supervised by the Saudi Central Bank. Implementation requires a target control set, named owners, technical and process changes, and current evidence for review.
How Limaz implements SAMA CSF
01
Scope the requirement
Establish which controls apply to your licence and activities, and which systems and owners they land on.
02
Map the current state
Review the policies, systems, owners, evidence, and gaps that exist today.
03
Design the target
Control architecture, decision rights, and what must change in process and technology.
04
Sequence the work
Create an implementation backlog with owners, dependencies, priorities, and acceptance criteria.
05
Connect evidence
Logs, approvals, tests, and artefacts tied to owners so reviews do not start from zero.
06
Validate and remediate
Prove operation, then close residual risk as measurable work.
Common implementation gaps
- Policies exist without implemented technical or process controls.
- Owners are named in documents but not in operating routines.
- Evidence is assembled for a review week, then decays.
- Remediation lists are not sequenced as engineering work.
- Third-party access sits outside the control model.
- Fraud and AML tooling is disconnected from the cybersecurity control set.
Where Naiza and Limaz solutions fit
SAMA CSF is broader than financial crime. Limaz implements the control program through cybersecurity and regulatory engineering. Where fraud, AML, screening, and decisioning need a product layer, Naiza by Limaz is used only in that slice.
Do not treat a fraud platform as a substitute for SAMA CSF implementation, and do not treat a policy pack as a substitute for either.
Related Limaz pages
NCA ECC implementation
When national cybersecurity controls also apply.
NCA ECC implementationSAMA payment systems
Control and resilience expectations for payment operations.
SAMA payment systemsSAMA IT governance framework
Decision rights and oversight for technology in supervised institutions.
SAMA IT governance frameworkNaiza by Limaz
Fraud and AML decisioning where it belongs in the operating model.
Naiza by LimazSecurity control implementation
Technical controls that make the framework operable.
Security control implementationQuestions
The Saudi Central Bank publishes the SAMA Cyber Security Framework for supervised financial institutions.
Map the current control state, define the target architecture and owners, sequence the implementation backlog, connect evidence sources, then validate and remediate. Limaz delivers the implementation work.
Applicability depends on SAMA supervision, licence, and activities.
SAMA CSF applies to SAMA-supervised financial institutions. NCA Essential Cybersecurity Controls apply to in-scope national entities as defined by NCA. Some organizations must operate both.
Last reviewed: Sep 12, 2026
Official sources
Discuss your requirements with Limaz
Tell us which system, control, or requirement you are working on. We’ll review the scope and suggest the next step.