SAMA Cyber Security Framework: Domains, Maturity Levels and Compliance Steps The SAMA CSF guide from Sumrite.

This guide is the hub for our SAMA and CST series. It explains what the framework is, who it binds, how its domains and maturity model work, and the practical steps from gap assessment to a level 3 evidence pack. Deeper guides cover SAMA penetration testing, SAMA ethical red teaming, NCA ECC vs SAMA CSF dual compliance and the CST Cybersecurity Regulatory Framework for ICT providers.

What is the SAMA Cyber Security Framework?

The SAMA Cyber Security Framework is the Saudi Central Bank’s mandatory control framework for identifying and managing cyber security risk in the financial institutions it regulates. SAMA issued it under Circular 381000091275, dated 24 May 2017 (28/8/1438H), and the SAMA Rulebook lists it as in force as of November 2026.

According to the framework’s introduction on the SAMA Rulebook, the SAMA CSF supersedes SAMA’s earlier cyber security circulars and has three stated purposes: to create a common approach to cyber security across Member Organizations, to achieve an appropriate maturity level of cyber security controls, and to ensure cyber security risks are properly managed. SAMA also uses the framework to periodically assess the maturity level and effectiveness of each Member Organization’s controls and to compare Member Organizations with each other.

Three features shape how the framework is applied in practice:

• Principle-based. Each subdomain gives a principle, an objective and “control considerations” rather than a fixed checklist, so the Member Organization decides how to implement them.
• Risk-based. Controls are expected to follow from the Member Organization’s own risk management process (subdomain 3.2.1), not a uniform baseline.
• Maturity-based. Compliance is measured as a maturity level, not a pass or fail.

Who must comply with the SAMA Cyber Security Framework?

The SAMA Cyber Security Framework applies to every Member Organization regulated by SAMA: banks, insurance and reinsurance companies, financing companies and credit bureaus operating in Saudi Arabia, and the financial market infrastructure. Section 1.3 extends the framework’s direction to a Member Organization’s subsidiaries as well.

Section 1.4 of the framework lists the covered entity types and sets a few exceptions for non-bank institutions:

Subdomain	Banks	Non-bank Member Organizations
3.1.2 Cyber Security Strategy	Applies	Alignment with the banking sector strategy is mandatory when applicable
3.2.3 Compliance with (Inter)national Industry Standards	Applies	Excluded; PCI and/or SWIFT CSCF should be implemented if the entity handles cardholder data or SWIFT services
3.3.12 Payment Systems and 3.3.13 Electronic Banking Services	Apply	Excluded; multi-factor authentication should be implemented if the entity offers online services to customers
All other subdomains	Apply	Apply

Fintechs at the sandbox or licensing stage sit under a lighter document. SAMA’s Cyber Resilience Fundamental Requirements (CRFR), dated 1 January 2022, apply to entities seeking to join the SAMA Regulatory Sandbox or applying for a licence, and SAMA states they are not a replacement for the Cyber Security and Business Continuity Management frameworks that apply once the entity is licensed.

What are the four domains of the SAMA Cyber Security Framework?

The four domains of the SAMA Cyber Security Framework are Cyber Security Leadership and Governance (3.1), Cyber Security Risk Management and Compliance (3.2), Cyber Security Operations and Technology (3.3) and Third Party Cyber Security (3.4). Each domain is split into numbered subdomains, and each subdomain carries a principle, an objective and control considerations.

The subdomains below are taken from Section 3, Control Domains, on the SAMA Rulebook:

Domain	Subdomains
3.1 Cyber Security Leadership and Governance	3.1.1 Governance · 3.1.2 Strategy · 3.1.3 Policy · 3.1.4 Roles and Responsibilities · 3.1.5 Cyber Security in Project Management · 3.1.6 Awareness · 3.1.7 Training
3.2 Cyber Security Risk Management and Compliance	3.2.1 Risk Management · 3.2.2 Regulatory Compliance · 3.2.3 Compliance with (Inter)national Industry Standards · 3.2.4 Cyber Security Review · 3.2.5 Cyber Security Audits
3.3 Cyber Security Operations and Technology	3.3.1 Human Resources · 3.3.2 Physical Security · 3.3.3 Asset Management · 3.3.4 Architecture · 3.3.5 Identity and Access Management · 3.3.6 Application Security · 3.3.7 Change Management · 3.3.8 Infrastructure Security · 3.3.9 Cryptography · 3.3.10 BYOD · 3.3.11 Secure Disposal · 3.3.12 Payment Systems · 3.3.13 Electronic Banking Services · 3.3.14 Event Management · 3.3.15 Incident Management · 3.3.16 Threat Management · 3.3.17 Vulnerability Management
3.4 Third Party Cyber Security	3.4.1 Contract and Vendor Management · 3.4.2 Outsourcing · 3.4.3 Cloud Computing

Which SAMA CSF subdomains generate the most testing work?

Four subdomains drive most technical assurance activity in a SAMA programme:

• 3.2.4 Cyber Security Review: periodic review of critical information assets, plus annual review and penetration tests of customer and internet-facing services.
• 3.3.7 Change Management: testing of changes, which should include penetration testing where applicable, and code review for internally developed applications.
• 3.3.17 Vulnerability Management: coverage of all information assets, risk-based scan frequency, classification and defined mitigation timelines.
• 3.4 Third Party Cyber Security: assurance over vendors, outsourcing and cloud providers, often supported by a vendor risk and TPRM programme.

What are the SAMA CSF maturity levels, and why does level 3 matter?

The SAMA CSF maturity model has six levels, from level 0 (Non-existent) to level 5 (Adaptive), and Section 2.4 states that Member Organizations should at least operate at maturity level 3 or higher. Level 3 is the floor, so a control that exists but is undocumented or unapproved does not meet the framework.

The level names below come from Table 1 of the SAMA CSF maturity model:

Level	Name	What it means in the SAMA text
0	Non-existent	No documentation; no awareness of the control
1	Ad-hoc	Controls not defined, or only partly defined
2	Repeatable but informal	Repeatable controls exist, but their objectives and design are not formally defined or approved
3	Structured and formalized	Controls are defined, approved and implemented in a structured and formalized way
4	Managed and measurable	Control effectiveness is periodically assessed and improved when necessary
5	Adaptive	Controls are subject to a continuous improvement plan

What does SAMA maturity level 3 require in practice?

According to section 2.4.1 of the framework, a Member Organization reaches level 3 when it defines, approves and implements its cyber security controls and also monitors compliance with its cyber security documentation. In audit terms, that translates into four tests for every control:

Table 1 also says level 3 compliance monitoring is preferably done with a GRC tool, and that KPIs are defined, monitored and reported. Level 4 adds measurement of effectiveness through KRIs and trend reporting, and level 5 adds a continuous improvement plan benchmarked against peer and sector data. The framework’s stated minimum remains level 3.

What does the SAMA CSF require for penetration testing and security review?

SAMA CSF subdomain 3.2.4 requires that customer and internet facing services be subject to annual review and penetration tests, with results recorded, reported to the business owner and followed up until issues are addressed. Subdomain 3.3.7 adds penetration testing, where applicable, to the testing of changes.

The text of SAMA CSF 3.2.4, Cyber Security Review, has five control considerations: periodic reviews of critical information assets; annual review and penetration tests of customer and internet-facing services; recording of results, issues and recommended actions; reporting to the business owner; and follow-up reviews to check that identified issues have been addressed, critical risks treated and agreed actions managed on an ongoing basis.

The follow-up requirement is where most programmes fall short of level 3: a pentest report with no tracked remediation and retest only satisfies part of 3.2.4. Our SAMA penetration testing guide covers scope, frequency and common mistakes in detail, and the Saudi penetration testing pillar guide maps each test type to SAMA and NCA controls. A sample VAPT report shows the evidence format reviewers expect.

Larger institutions also face intelligence-led red teaming. SAMA’s Financial Entities Ethical Red Teaming Framework, issued under Circular 562240000067 dated 13 May 2019, is a separate document and does not replace 3.2.4 testing.

How do you achieve SAMA CSF compliance, step by step?

SAMA CSF compliance is reached by scoping the framework to your entity type, assessing current maturity per subdomain, closing gaps to at least level 3, and keeping evidence that each control is defined, approved, implemented and monitored. The sequence below is the one we use with Saudi financial institutions.

How does the SAMA CSF relate to NCA ECC, the CRFR and FEER?

The SAMA CSF is the core cyber security framework for SAMA Member Organizations, and it sits alongside the NCA’s Essential Cybersecurity Controls, SAMA’s Cyber Resilience Fundamental Requirements for sandbox and licence-stage entities, and SAMA’s ethical red teaming framework. These documents overlap but none replaces another.

SAMA Cyber Security Framework (2017)

Core framework for all SAMA Member Organizations; maturity level 3 minimum; annual pentest of customer and internet-facing services (3.2.4).

SAMA CRFR (2022)

For sandbox entrants and licence applicants; [control 3.2.6](https://rulebook.sama.gov.sa/en/entiresection/3799) sets penetration testing twice a year as a minimum or after major or critical change.

SAMA FEER (2019)

Threat-intelligence-based red teaming against live production; SAMA can select any Member Organization to run a test. See [SAMA red teaming vs penetration testing](/blog/sama-red-teaming-vs-penetration-testing).

NCA ECC-2:2024

Applies to government entities and private entities that own, operate or host Critical National Infrastructure; periodic pentests of internet-facing services under 2-11. See [NCA ECC compliance](/blog/nca-ecc-compliance).

The NCA ECC-2:2024 document applies to private-sector entities that own, operate or host Critical National Infrastructure, so a financial institution in that position works to both frameworks. Our NCA ECC vs SAMA CSF guide shows how to run one control register and one penetration testing programme that serve both. ICT and hosting providers serving the financial sector usually also answer to the CST Cybersecurity Regulatory Framework.

How Sumrite helps

Sumrite supports SAMA Member Organizations and fintechs end to end with our verified NCA-registered partner firm, and has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. We run the technical assurance a SAMA programme depends on: web application VAPT, mobile app VAPT, API security testing for open banking and partner APIs, and red team operations for institutions preparing for FEER. Every engagement includes a retest and an evidence pack mapped to SAMA CSF 3.2.4 and, where relevant, NCA ECC 2-11. Saudi teams can start from our Saudi Arabia page, which explains how we turn around a VAPT report for Saudi reviews in 48 hours.