Saudi Central Bank
Prepare for SAMA F.E.E.R. exercises through controlled scope, threat-informed scenarios, coordinated safeguards and accountable remediation.
SAMA’s Financial Entities Ethical Red-Teaming Framework guides controlled, threat-intelligence-based testing of financial institutions’ resilience. The Rulebook marks the framework issued under circular 562240000067 of 13 May 2019 as in force. Its purpose includes testing detection and response against realistic sophisticated attacks. The framework distinguishes red teaming from an audit and from a conventional penetration test focused on particular information assets.
IRIS Technology can support exercise readiness, security-control improvement and remediation planning around the framework. Start with the organization’s important services, threat context, monitoring coverage and ability to coordinate safely. Clearly distinguish preparation support from delivery of a regulated red-team engagement: provider eligibility, qualifications and appointment must be checked for the specific exercise. Practical activities below describe preparation and improvement opportunities, not a claim that IRIS holds a regulator accreditation or approval.
The framework concerns financial-sector member organizations regulated by SAMA, and SAMA may select an organization for testing. Confirm current supervisory instructions, exercise scope, provider requirements and coordination arrangements before proceeding. Do not infer that every company supplying a bank must independently complete a F.E.E.R. exercise, or that a general vulnerability assessment satisfies a regulated institution’s red-team obligations.
Because the framework discusses controlled attacks against live production environments, exercise authorization and operational safeguards are essential. Agree boundaries, sensitive assets, escalation routes, conditions for pausing and evidence handling with authorized stakeholders. Verify scheduling and frequency with current directions: official publications contain differing wording about the population subject to minimum periodic testing, so a universal interval should not be assumed from a summary page.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Exercise governance | Confirm sponsorship, responsibilities, authorization and regulator coordination. | Approved scope, engagement governance and documented decisions. |
| Threat-informed scenarios | Connect credible threat intelligence to critical services and attack objectives. | Reviewed scenarios, target rationale and agreed objectives. |
| Operational safeguards | Define escalation, stop conditions and protection of sensitive information. | Safety arrangements, contacts and evidence-handling rules. |
| Detection and response readiness | Review telemetry, escalation paths and response responsibilities before exercise planning. | Coverage maps, response procedures and known limitations. |
| Remediation and learning | Turn findings into control improvements and proportionate validation. | Action register, ownership and evidence of verified improvements. |
Identify where critical-service telemetry is incomplete and confirm who can make operational decisions during testing. Readiness work should expose limitations early so authorized stakeholders can plan the exercise responsibly.
Connect observed attack paths and response weaknesses to specific controls, service owners and remediation deadlines. Reassessment should demonstrate the improvement rather than merely close a tracking ticket.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
No. The framework describes realistic threat-informed attacks across the organization to assess resilience, detection and response. A penetration test commonly examines defined assets or vulnerabilities.
The framework explicitly distinguishes it from an audit. Exercise outcomes can inform risk and improvement decisions, but they should not be presented as a comprehensive compliance opinion.
Confirm the applicable current SAMA instruction for the institution. Official materials have differing wording on minimum testing frequency and population; avoid applying one blanket interval to every regulated entity.
Do not assume so. The framework refers to certified and experienced providers. Validate current provider requirements, personnel competence and engagement authorization before appointing a delivery team.
A scoped preparation assessment, critical-service and monitoring maps, coordination requirements and an improvement backlog. The regulated exercise itself requires its own agreed objectives, provider checks and operating safeguards.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness