Saudi Central Bank
Prepare for applicable SAMA CRFR expectations with practical cybersecurity foundations, resilience controls, gap assessment and licensing evidence.
SAMA’s Cyber Resilience Fundamental Requirements focus on entities in the early stages of financial-sector operations. The Rulebook marks the requirements dated 1 January 2022 as in force and describes their role in the regulatory sandbox and licensing process. They provide a prioritized foundation for protecting information assets while recognizing the resource constraints that emerging financial businesses face. The requirements connect governance, security operations, technology protection and resilience.
IRIS Technology can support a scoped CRFR readiness assessment and implementation roadmap for relevant applicants. The work should trace the business operating model through its information assets, infrastructure, networks, applications and outsourced services. Establish what is implemented, what is operating effectively and what evidence supports the assessment. Practical implementation suggestions on this page are examples of delivery support; they do not replace the official requirements or SAMA’s review of an application.
The published applicability covers entities intending to qualify for SAMA’s Regulatory Sandbox environment and/or seeking a license to operate in Saudi Arabia. The Rulebook categorizes the scope under Finance Sector, Payment Systems and Payment Services Providers, Money Exchange Sector and Regulatory Sandbox. Confirm the proposed activity, application stage and specific supervisory instructions before selecting controls or assuming a particular licensing pathway.
CRFR is not a replacement for SAMA’s Cyber Security Framework or Business Continuity Management Framework. Other relevant requirements may apply following the licensing decision, and sandbox requirements must also be considered. Design foundational controls so the organization can extend them as its operating scope grows. A cloud provider’s certification, a security product subscription or a completed assessment does not guarantee sandbox graduation or license approval.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Security leadership | Define accountable governance, resources and practical security policies. | Approved roles, policies and management decisions. |
| Risk and service mapping | Assess infrastructure, networks, applications and business-model risks. | Service diagrams, central risk register and treatment decisions. |
| Identity and network protection | Review access lifecycle, segmentation, secure configurations and changes. | Access approvals, configuration records and change evidence. |
| Operational detection and response | Connect logging, monitoring and incident handling to named responsibilities. | Coverage records, response procedures and exercise findings. |
| Resilience foundations | Validate recovery arrangements for critical services and their dependencies. | Recovery procedures, restoration results and improvement actions. |
Map the division of responsibilities between the applicant and provider. Check customer-controlled identities, network settings, logging and recovery instead of relying only on the provider’s assurance report.
Review whether foundational processes can support the next operating stage. Preserve useful evidence while mapping additional applicable cybersecurity and continuity requirements into the implementation roadmap.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
Its published purpose is early-stage financial entities and the sandbox or licensing context. Confirm the actual regulatory instructions instead of substituting CRFR for an established institution’s applicable frameworks.
No. The published requirements explicitly distinguish the fundamental requirements from the Cyber Security and Business Continuity frameworks and relevant post-licensing obligations.
A provider can deliver important safeguards, but the applicant still needs to understand and evidence its own obligations. Review shared responsibilities, configuration, access and service dependencies.
Agree a scope covering applicable requirements, risk assessment, implementation gaps, remediation priorities and supporting evidence. Technical validation should use authorized access and proportionate methods.
No. A readiness assessment supports preparation. SAMA retains the licensing and supervisory decision, and other regulatory or business conditions may also affect the application.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness