SAMA CSF implementation
Cybersecurity control implementation for supervised institutions.
SAMA CSF implementationCompliance service
Make SAMA IT governance operational.
Limaz turns IT governance expectations into decision rights, owners, and working routines, then builds the evidence that shows they operate — for SAMA-supervised institutions.
What Limaz delivers
- ITGF readiness and gap assessment
- Governance structures, decision rights, and accountable owners
- Technology risk, portfolio, and performance routines that actually run
- Policy and process changes implemented, not just drafted
- Evidence model, validation, and reporting for supervisory review
What IT governance expectations cover
IT governance concerns who decides, on what basis, and with what oversight: technology strategy and its link to business objectives, portfolio and investment decisions, technology and third-party risk, resourcing and capability, performance measurement, and reporting to executive and board level.
The failure mode is familiar. Structures exist on paper, meetings happen, and nothing about how decisions get made actually changes. Evidence then has to be reconstructed under review.
How Limaz implements ITGF
01
Scope the requirement
Establish which governance expectations apply to your institution and where accountability sits today.
02
Map decisions, not documents
Identify how technology decisions are made today, by whom, and where accountability actually sits.
03
Design the governance model
Structures, decision rights, escalation, and the reporting line to executive and board level.
04
Rebuild the routines
Portfolio review, risk acceptance, exception handling, and performance reporting as routines people run.
05
Connect evidence
Minutes, approvals, risk decisions, and reports tied to owners and produced as a by-product of operating.
06
Validate and remediate
Test whether the model holds under real decisions, then close the gaps as measurable work.
Common implementation gaps
- Committees exist but decisions are made elsewhere.
- Risk acceptance has no owner, expiry, or review.
- Technology strategy is not traceable to portfolio decisions.
- Third-party dependencies are governed by contract only.
- Board reporting describes activity rather than risk and outcomes.
- Evidence is reconstructed for review instead of produced by operating.
Where this sits alongside SAMA CSF
CSF asks whether controls are implemented and operating. ITGF asks whether the institution is governing technology well enough to keep them that way. Institutions that implement them separately usually build the evidence model twice.
Limaz implements both through the same delivery program so ownership, routines, and evidence are defined once.
Related Limaz pages
SAMA payment systems
Control and resilience expectations for payment operations.
SAMA payment systemsCybersecurity risk management
Risk routines that governance depends on.
Cybersecurity risk managementCybersecurity and regulatory engineering
The delivery program behind SAMA control implementation.
Cybersecurity and regulatory engineeringQuestions
The Saudi Central Bank sets expectations for how supervised institutions govern technology: structures, decision rights, oversight, and accountability.
ITGF is the common abbreviation for the IT Governance Framework issued by the Saudi Central Bank for the institutions it supervises.
CSF concerns cybersecurity controls. ITGF concerns how technology decisions are made, owned, and overseen — strategy, portfolio, risk, resourcing, and performance. They overlap in evidence and ownership, which is why the two are best implemented together.
It should not be. Governance that exists only in a committee charter does not survive review. The test is whether decisions are actually made, recorded, and traceable to named owners in normal operation.
Last reviewed: Sep 12, 2026
Official sources
Discuss your requirements with Limaz
Tell us which system, control, or requirement you are working on. We’ll review the scope and suggest the next step.