Digital customer onboarding
Map identity proofing, APIs, suppliers, personal information and monitoring. Validate access and incident escalation across the journey.
All frameworks & requirements
Saudi Central Bank
SAMA Cybersecurity Framework Readiness
Build SAMA cybersecurity readiness through accountable governance, risk management, operating controls, supplier oversight and evidence of maturity.
Published SAMA Rulebook framework; verify applicable directionsSources reviewed: 4 November 2026
Understand the requirement. Connect it to operations.
The SAMA Cyber Security Framework sets a common approach to managing cyber risk and assessing control maturity at regulated member organizations. Its structure covers governance, risk/compliance, operations/technology and third-party cybersecurity. It is an institutional operating framework, not a shopping list of security products.
A readiness engagement should connect executive oversight to financial services. Map critical customer journeys, applications, identities, data and suppliers, then evaluate how controls are designed, operated, evidenced and improved. A policy can establish intent without proving that a control works.
Confirm applicability before choosing controls.
Confirm the entity's current regulatory perimeter, license, applicable SAMA requirements and supervisory directions. The published framework describes member organizations and sector-specific applicability. Do not assume every fintech, supplier or financial-service business has an identical control set.
Keep cybersecurity, continuity, outsourcing, privacy and other relevant requirements mapped to a common control system while preserving distinct obligations. Review current authority arrangements and instructions instead of relying solely on the original framework's list of sectors.
Turn requirements into implementation and evidence.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Leadership and ownership | Link strategy, accountable roles and oversight to business risk. | Committee decisions, responsibilities and tracked action plans. |
| Risk and compliance | Assess services, dependencies and accepted exceptions consistently. | Risk register, control mapping and approval records. |
| Operational security | Validate identities, applications, infrastructure and monitoring coverage. | Access reviews, configuration checks and response records. |
| Third-party exposure | Assess outsourcing, supplier access and cloud responsibilities. | Due diligence, contract controls and review evidence. |
| Maturity and effectiveness | Use repeatable evidence and validation rather than unsupported scores. | Assessment rationale, test results and improvement measures. |
What this looks like in practice.
An outsourced security service
Check what the service monitors, who authorizes containment and how evidence reaches the institution. Outsourcing execution does not remove accountability.
From readiness assessment to working controls.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Assess and prioritize
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Design the improvements
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Implement and validate
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Handover and sustain
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Agree concrete deliverables.
- A scope and applicability record with assumptions and responsibilities.
- A gap/risk register and prioritized remediation roadmap.
- Control mapping, architecture recommendations and operating procedures.
- An evidence register, agreed validation results and handover material.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
Common questions.
Is SAMA readiness the same as NCA readiness?
No. Determine applicable national and sector requirements, then map them to shared controls. An assessment against one framework is not automatic evidence of the other.
Can you guarantee a maturity level?
No. Assessment conclusions must follow the applicable method and defensible evidence. Supervisory judgments remain with the competent authority.
Is a policy document enough?
No. Show that the process operates, owners review outcomes and exceptions are treated. Evidence should support implementation and effectiveness.
Does this include business continuity?
Coordinate cybersecurity with applicable continuity requirements and recovery plans. This framework is not the complete set of continuity obligations.
Does this mean IRIS is approved by SAMA?
No. This page describes readiness and implementation support. It makes no claim of regulatory approval, authorized certification or a guaranteed supervisory outcome.
Start with the official sources.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Related frameworks and requirements
Define the right scope for your organization.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness