Home / Knowledge hub / SAMA cyber security framework
Knowledge hub
SAMA cyber security framework
Saudi central bank rules for cyber security at financial institutions.
What it means
The SAMA Cyber Security Framework is a set of cyber security requirements issued by the Saudi central bank, which still goes by the name SAMA. It applies to the financial institutions the bank regulates, such as banks, insurers and finance companies. It sits beside the national controls from the NCA, and the two are used together.
The framework is organised into four main domains: cyber security leadership and governance, risk management and compliance, operations and technology, and third-party security. Institutions assess themselves against a maturity scale, from not existing at all up to an adaptive, continuously improving level, and must reach the level the framework expects.
Why it matters
A regulated institution answers to its regulator, so its suppliers are pulled in. A bank buying a mobile app, a payments API or a customer portal has to show that third parties meet its standards. A supplier that cannot produce test reports, a patching record and an incident process can lose the deal at the review stage.
Maturity is the other pressure. The framework asks not only whether a control exists but whether it is defined, followed and measured. One-off tests do less for that than a routine that finds, fixes and rechecks, backed by evidence that anyone can read.
How it shows up
For an application, the framework shows up in questions about secure development, vulnerability management and penetration testing, logging, access control and incident handling. The third-party domain is where suppliers meet it: contracts, assessments, right to audit and ongoing monitoring of the supplier’s security.
Mistakes repeat. A supplier sends a certificate instead of evidence about the application the bank will use. Test scope excludes the API behind the mobile app. Fixes are claimed but never retested. Offer a recent penetration test on the exact service in scope, with the retest, and keep it current.
Questions people ask
SAMA cyber security framework, answered
Who has to follow the SAMA framework?
Financial institutions regulated by the Saudi central bank, including banks, insurance companies and finance companies. Their suppliers meet it through contract and third-party reviews.
The central bank publishes the list of covered entities.
How is it different from NCA ECC?
The SAMA framework is sector-specific for financial institutions and uses a maturity model. The NCA ECC is a national baseline for government and critical infrastructure bodies. A bank may need to meet both.
Evidence often overlaps.
Does it require penetration testing?
The framework includes requirements for vulnerability management and for testing, and regulated institutions commonly require independent tests of customer-facing systems before and after changes.
Check the current text and the customer’s own policy.
What are the maturity levels?
A scale that runs from non-existent through ad hoc, repeatable, structured and managed, up to adaptive. Institutions assess each area and aim for a level the regulator sets.
Higher levels need measurement, not just a written policy.
What do suppliers need to prepare?
Policies for secure development, a record of vulnerabilities found and fixed, recent test reports for the service in scope, incident procedures and answers on data location and access.
Keep the retest results with each report.
Sources
Where this comes from
Related
Terms that sit next to this one
NCA ECC
Saudi Arabia's Essential Cybersecurity Controls for national organisations.
Vendor risk management
Judging and monitoring the security of the suppliers your business relies on.
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
Vulnerability management
The loop of finding, prioritising, fixing and checking the fix held.
Data residency
Where in the world your customers' data is physically stored.
Can a supplier prove the fix held?
A bank reviewer wants the retest, not a promise. Our findings arrive with the request, the response and the line of code, and a fix is proven by re-running the exact exploit. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.