Saudi Arabia · Regulation guide
SAMA Cyber Security Framework
Issued by Saudi Central Bank (SAMA)
Applies to: Banks, insurers, finance companies and other organisations regulated by SAMA.
SAMA’s Cyber Security Framework sets out cybersecurity requirements for regulated financial institutions across leadership and governance, risk management and compliance, operations and technology, and third-party security.
Institutions assess their maturity against the framework and are expected to reach and sustain the level SAMA requires. SAMA also issues related requirements, including for business continuity.
General guidance, not legal advice. Always confirm scope and current requirements with the issuing authority.
Discuss SAMA CSF with us
Gap assessment, control mapping or evidence tracking.
How we help
- ✓Maturity assessment against the framework
- ✓Remediation roadmap prioritised by risk
- ✓Mapping to ISO/IEC 27001 and ISO 22301
- ✓Evidence and maturity tracking in GRC software
- ✓Board and committee reporting packs
Related ISO standards
Related software guides
SAMA CSF questions
Is this legal advice?+
No. This is a general overview. Confirm scope, the current edition and your obligations with the issuing authority and your legal or compliance advisers.
Next step
Where does your programme stand?
The GRC maturity check takes three minutes and shows which areas to fix first.