A core-platform upgrade
Review governance, capacity, supplier dependencies and release controls before implementation. Preserve approval, testing and rollback evidence so reviewers can trace the operational decision.
Saudi regulatory frameworks
Saudi Central Bank
SAMA IT Governance Framework Readiness
Build SAMA IT governance readiness through a focused gap assessment, accountable IT operations, controlled change and demonstrable evidence.
Published Information Technology Governance FrameworkSources reviewed: 4 November 2026
Understand the requirement. Connect it to operations.
SAMA’s Information Technology Governance Framework establishes principles and control requirements for addressing IT risks within regulated member organizations. The Rulebook identifies the framework issued under circular 43028139 of 4 November 2021 as in force. Its four domains cover IT governance and leadership, IT risk management, IT operations management and system change management. These subjects connect technology decisions to reliable financial services, rather than treating governance as a policy-writing exercise.
IRIS Technology can support a practical readiness program that links governance decisions to infrastructure, applications, networks and service operations. Begin with a gap assessment that distinguishes an absent control from a control that operates without reliable evidence. Prioritize actions by service consequence, implementation effort and dependency. The practical activities below illustrate delivery approaches; the official framework and current supervisory directions determine mandatory requirements.
Confirm applicability before choosing controls.
Confirm the institution’s supervisory perimeter and applicable directions before agreeing the assessment boundary. The Rulebook lists Banking Sector and Credit Bureaus, while the framework describes applicability to SAMA-regulated member organizations. Assess the actual institution, relevant information assets and dependencies, including subsidiaries and third parties where relevant. Do not assume every Saudi company or financial-technology supplier is directly subject to identical requirements.
The framework is intended to operate alongside SAMA’s Cyber Security Framework and Business Continuity Management Framework. Maintain separate requirement references while reusing valid evidence across shared controls. Its maturity model uses levels zero through five; a maturity conclusion needs evidence of implementation and operation. A software purchase, documented policy or external certification alone cannot establish the maturity of the institution’s entire IT environment.
Turn requirements into implementation and evidence.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Governance and accountability | Map IT strategy, decision rights, committees and service ownership to business objectives. | Approved responsibilities, meeting records and tracked decisions. |
| IT risk management | Assess service dependencies, risk exposure, exceptions and treatment ownership. | Risk register, assessment rationale and approved treatment plans. |
| Reliable operations | Review inventories, configuration, capacity, availability and operational handoffs. | Validated records, operational reports and incident follow-up. |
| Controlled change | Connect requests, testing, approvals, release decisions and recovery arrangements. | Change records, test results and authorization evidence. |
| Maturity and improvement | Evaluate implementation consistently and assign actions to accountable owners. | Evidence index, justified ratings and monitored remediation. |
What this looks like in practice.
Recurring service instability
Examine incident trends, configuration changes and service ownership together. A practical improvement plan might combine monitoring changes, clearer escalation and stronger release discipline.
From readiness assessment to working controls.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Assess and prioritize
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Design the improvements
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Implement and validate
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Handover and sustain
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Agree concrete deliverables.
- A scope and applicability record with assumptions and responsibilities.
- A gap/risk register and prioritized remediation roadmap.
- Control mapping, architecture recommendations and operating procedures.
- An evidence register, agreed validation results and handover material.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
Common questions.
Is IT governance the same as SAMA cybersecurity?
No. IT governance addresses wider technology management and risk. Cybersecurity and continuity have their own frameworks, which should be mapped alongside the applicable IT governance requirements.
Does the framework apply to every technology supplier?
Direct applicability follows the regulatory perimeter and directions. Suppliers may also face contractual requirements supporting a regulated customer; distinguish those obligations from direct supervision.
Can a policy library demonstrate maturity?
Policies are part of the evidence. Assessors also need to understand implementation, operating records, monitoring and improvement. A documented process that staff do not follow leaves a material gap.
What should a readiness assessment deliver?
A confirmed scope, requirement mapping, evidence-based gaps, maturity rationale and prioritized remediation plan. Agree detailed deliverables and validation methods for the institution and services being assessed.
Does IRIS issue SAMA approval?
No. IRIS can support assessment, implementation and evidence preparation. Formal regulatory interpretation, supervisory decisions and acceptance remain with SAMA.
Start with the official sources.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Related frameworks and requirements
Define the right scope for your organization.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness