Financial-sector cyber regulation in Saudi Arabia and Jordan: design for evidence, maturity, and resilience

Financial-sector regulation should not produce separate control libraries for every authority, business unit, and audit. A stronger model begins with critical services, business risk, information assets, identities, applications, infrastructure, third parties, resilience, and accountable owners—then maps each applicable regulatory requirement to that operating system.

In Saudi Arabia, the SAMA Cyber Security Framework establishes a common approach to cyber risk and maturity for regulated member organizations. Its published scope includes banks, insurers and reinsurers, financing companies, credit bureaus, and financial-market infrastructure. Depending on the entity and environment, NCA controls may add national requirements across essential cybersecurity, critical systems, cloud, data, or operational technology.

SIMAH should be described accurately: it is the Saudi Credit Bureau and an important credit-information ecosystem entity, not a regulator. For institutions connecting to credit-information services, the practical control questions include identity, authorization, API protection, data purpose, privacy, encryption, audit trails, third-party dependency, availability, recovery, and evidence that access remains appropriate.

Saudi financial-sector assurance also extends beyond documentation. SAMA’s Financial Entities Ethical Red-Teaming framework provides a model for threat-intelligence-led, controlled testing of live production environments. That raises the standard from confirming that controls exist to testing whether people, detection, escalation, containment, and decision-making work together under realistic pressure.

In Jordan, the Central Bank of Jordan publishes a Cybersecurity Framework for the Financial Sector and operates Jo-FinCERT to strengthen coordination and cyber readiness across supervised institutions. The useful architectural response is the same: map critical services, define minimum controls, engineer evidence, test response and recovery, and feed lessons back into governance and investment.

For institutions operating across markets, use one enterprise control baseline with clearly mapped national and sector overlays. Keep applicability, ownership, evidence, testing, exceptions, and remediation in one governance system. This reduces duplication while preserving the specificity regulators and executive management need.