SAMA Cyber
Security Framework

SAMA, the Saudi Arabian Monetary Authority, is the central bank of Saudi Arabia responsible for regulating and supervising financial institutions.

All financial institutions including banks, insurance companies, finance companies, and other entities operating under SAMA's jurisdiction in Saudi Arabia.

The framework covers various aspects of cybersecurity, including governance, risk management, compliance, asset protection, incident response, and recovery. It mandates implementing security measures to safeguard sensitive information and mitigate cyber threats effectively.

The SAMA Cyber Security Framework includes the following main control domains:

1. Cybersecurity Governance: Ensures clear policies and accountability.
2. Cybersecurity Risk Management: Identifies and mitigates risks.
3. Cybersecurity Operations: Manages security tools and controls.
4. Third-Party Cybersecurity: Ensures vendors comply with security standards.

1. Cybersecurity Leadership and Governance - This domain ensures strong governance by involving the board in overseeing cybersecurity strategies, creating dedicated committees, and maintaining an independent cybersecurity function to enforce policies effectively.

2. Cybersecurity Risk Management - Focuses on identifying, analyzing, and mitigating risks to protect critical information assets, ensuring their confidentiality, integrity, and availability through robust risk management practices.

3. Cybersecurity Operations and Technology - Covers the technical aspects of cybersecurity, requiring the implementation of security controls, access management, and continuous monitoring to protect systems and sensitive data.

4. Third-Party Cybersecurity - Ensures third-party service providers meet the same cybersecurity standards as the organization by defining requirements and monitoring compliance regularly.