How the self-assessment works
Under the SAMA Cyber Security Framework (SAMA CSF), each member organization assesses itself periodically using SAMA's self-assessment questionnaire. SAMA then reviews and audits the self-assessment to determine the organization's compliance and its maturity level.
The self-assessment is not a form to complete. It is a statement to your regulator about how your controls operate, and every score is expected to stand up to evidence.
The six maturity levels
SAMA CSF measures each subdomain on a scale from 0 to 5. Member organizations should operate at level 3 or higher. To reach a level, every criterion of the levels below it must also be met.
| Level | Name | What it looks like in practice |
|---|---|---|
| 0 | Non-existent | No control is documented or practised |
| 1 | Ad-hoc | Individuals do the work when they remember, inconsistently and without documentation |
| 2 | Repeatable but informal | The work happens regularly, but it is not formally defined, approved or evidenced |
| 3 | Structured and formalized | The control is defined, approved, implemented across its full scope and evidenced. This is the minimum. |
| 4 | Managed and measurable | The control is measured with KPIs, reviewed and improved on the results |
| 5 | Adaptive | The control adapts continuously to measurement, incidents and changes in the threat landscape |
The four tests for level 3
A subdomain reaches level 3 when all four of these hold:
- Defined and approved. A policy or standard describes the control, and the right authority approved it, usually the cyber security committee or the board.
- Implemented across the full scope. It applies to every relevant system, entity and team, not only the core platform.
- Operated consistently. Records show it ran as designed, on schedule, over a meaningful period.
- Owned. A named person is accountable, can explain the control and can show its evidence.
If any one of the four fails, the subdomain is at level 2, however good the documents look.
Scoring one subdomain: a worked example
Take identity and access management, subdomain 3.3.5 of the framework. Work through the questions in order:
| Question | Evidence | Result |
|---|---|---|
| Is there an approved access management policy? | Policy, version, approval minutes | Yes |
| Is multi-factor authentication enforced for remote and privileged access? | Identity provider configuration, exception list | Yes |
| Are user access reviews performed on schedule? | Review records for the last two quarters | Yes for core banking, no for the cloud console |
| Are leavers removed within the defined time? | HR leaver list matched to deactivation tickets | Yes |
| Are privileged sessions logged and reviewed? | Session logs, review sign-off | Yes |
The access review gap means the control is not implemented across its full scope. Score the subdomain at level 2, record the gap, and set a remediation date. Scoring it at level 3 because most of it works is the mistake reviewers find first.
The rule: score the weakest consistently applied state, not the best system.
Evidence that holds up
- Approved documents that are current, versioned and signed.
- Records over time. Several months of operation, not a single example produced the week before submission.
- Complete populations. Evidence that covers every in-scope system, or a documented sample drawn from the full list.
- Traceability. Each piece of evidence points to the subdomain and control it supports.
- Exceptions on file. Approved exceptions, with expiry dates and compensating controls.
Gaps, compensating controls and waivers
When a control consideration cannot be implemented, SAMA CSF sets out the route: consider a compensating control, record an internal risk acceptance, and request a formal waiver from SAMA.
A gap you have documented, with an owner, a plan and a date, shows a functioning governance process. A gap SAMA finds on its own shows the opposite.
Common scoring mistakes
- Scoring the documents instead of the operation.
- Scoring the core platform and ignoring cloud, SaaS and subsidiaries.
- Claiming level 4 without KPIs that have actual results over time.
- Submitting evidence older than the review period.
- Control owners who cannot explain how their control works.
- Different teams scoring related subdomains on different standards.
From level 3 to level 4
Level 4 is about measurement. For each subdomain, define KPIs with targets, report the results to the cyber security committee, and show decisions taken on them. Examples: the percentage of access reviews completed on time, mean time to remediate critical vulnerabilities, or the share of vendors reassessed within their review cycle. SAMA also publishes specific requirements for maturity level 4.
Running the assessment
- Assign an owner to each of the 32 subdomains.
- Agree the scoring rules before anyone scores, including the weakest-state rule.
- Have owners score with evidence, then challenge every score independently.
- Consolidate, record gaps, and agree remediation plans with dates.
- Present results to the cyber security committee for approval before submission.
Limaz runs SAMA CSF assessments and the remediation that follows, from scoring to evidence. See our SAMA CSF implementation service, or read SAMA CSF for fintechs for a year-one build plan.