What SAMA CSF is
The SAMA Cyber Security Framework (SAMA CSF) is the cybersecurity standard published by the Saudi Central Bank for the financial institutions it supervises. It sets out the security expectations for banks, insurance and reinsurance companies, financing companies, credit bureaus, and the financial market infrastructure in Saudi Arabia.
SAMA CSF is not a certification scheme. There is no external body that issues a "SAMA CSF certificate." Compliance is demonstrated through each institution's periodic self-assessment, which SAMA reviews and audits. The maturity rating that counts is the one the regulator confirms, not the one a vendor prints on a slide.
Who it applies to
SAMA CSF applies to every institution SAMA supervises: licensed banks, financing and leasing companies, insurance and reinsurance companies, credit bureaus, and payment service providers. If SAMA licenses you, the framework applies to you.
This is why SAMA CSF frequently affects fintechs and payment companies, not only the large banks. A newly licensed payment institution still has to build the framework into its first year of operation.
The four domains
The framework is organised into four domains, each with subdomains that spell out the control expectation:
| Domain | What it covers | Subdomains |
|---|---|---|
| 3.1 Cyber security leadership and governance | Board accountability, a cyber security committee, a CISO independent of IT | 7 |
| 3.2 Cyber security risk management and compliance | A managed risk register, regulatory compliance, testing and audit | 5 |
| 3.3 Cyber security operations and technology | The engineering controls: access, infrastructure, applications, cryptography, monitoring, incident response | 17 |
| 3.4 Third party cyber security | Vendors, outsourcing, and cloud — including SAMA approval before public cloud | 3 |
Each subdomain states a principle, an objective, and control considerations. The framework is principle-based: it defines the outcome SAMA expects and leaves the technical design to you. Two institutions can satisfy the same subdomain with different tools, so evidence carries more weight than product names.
The maturity model
Every subdomain is scored on a maturity scale from 0 to 5, and SAMA expects institutions to operate at level 3 or higher. To reach a level, every level below it must be met as well.
| Level | Name | The practical test |
|---|---|---|
| 0 | Non-existent | No control exists |
| 1 | Ad-hoc | Individuals do the work inconsistently, with no documentation |
| 2 | Repeatable but informal | The work happens regularly but is not formally defined or evidenced |
| 3 | Structured and formalized | Defined, approved, implemented across its full scope, and evidenced. The minimum. |
| 4 | Managed and measurable | Measured with KPIs and improved on results |
| 5 | Adaptive | Adapts continuously to incidents and threats |
SAMA has also published separate maturity level 4 requirements, so level 3 is a floor, not a finish line.
How the framework is enforced
SAMA does not certify you, and no auditor issues a certificate. Instead:
- The institution runs a self-assessment against the framework questionnaire.
- SAMA reviews and audits that self-assessment.
- SAMA confirms the maturity levels and follows up on gaps.
For institutions that also fall under the National Cybersecurity Authority, the NCA Essential Cybersecurity Controls (ECC) and Cloud Cybersecurity Controls (CCC) run alongside SAMA CSF. The two sets of requirements overlap in places, and an institution under both operates a single control register that answers both.
What implementation looks like in practice
Bringing SAMA CSF to level 3 across all subdomains is an operating program, not a documentation exercise:
- Name owners. Every subdomain gets a named person accountable for it.
- Close the gap between policy and operation. Policies need implemented technical and process controls behind them.
- Make evidence routine. Logs, approvals, tests, and records collected continuously, not assembled the week before submission.
- Manage third parties. Cloud, outsourcing, and vendor access sit inside the control model.
- Connect it to fraud and AML tooling. The framework expects the security side of financial crime controls to be in scope, not siloed.
Common gaps we see
- Policies exist but no implemented control behind them.
- Owners are named on paper but not in daily routines.
- Evidence decays between review cycles.
- Remediation is a list, not engineered work.
- Public or hybrid cloud is used or planned without the SAMA approval the framework requires.
Where to start
Start with an honest readiness assessment, not a remediation wish-list. Map which subdomains apply to your licence, who owns them, what the current state is, and where the evidence is thin. That baseline tells you whether you are nearest to the governance, the engineering, or the third-party work.
Limaz runs SAMA CSF readiness assessments and the implementation that follows, from control mapping to evidence. See the SAMA CSF assessment & compliance service, the SAMA CSF for fintechs year-one plan, or how the self-assessment is scored.