Compliance
SAMA
Strengthen SAMA Compliance and Reduce Financial Cyber Risk
Enforce access controls, manage risk, and maintain audit readiness to meet SAMA Cyber Security Framework requirements.
Trusted by
What is SAMA Compliance?
SAMA Compliance requires financial institutions in Saudi Arabia to follow the SAMA Cyber Security Framework (CSF), which defines 20 control objectives and over 100 sub-controls. It focuses on governance, risk management, and security to protect financial systems and data. Organizations must implement controls, assess maturity, and maintain continuous monitoring.
Why is SAMA compliance critical?
SAMA compliance ensures financial systems and customer data are protected through strong governance & risk controls. Without it, organizations face regulatory penalties, weak oversight, & operational risk. Compliance strengthens resilience, audit readiness, and trust.
Weak Risk Governance
Limited oversight increases exposure to financial and cyber risks.
Poor Access Control
Uncontrolled access impacts sensitive financial systems.
Limited Audit Visibility
Inability to demonstrate compliance to regulators.
Third-Party Risk
Vendors introduce security and compliance vulnerabilities.
Compliance Gaps
Failure to meet SAMA control objectives impacts certification.
DATASHEET
SAMA Compliance Guide
Get a structured approach to meet SAMA CSF requirements and improve maturity.
How to meet SAMA CSF control objectives and maturity expectations
Key Control Objectives
What this requires
Organizations must establish a formal governance structure with defined policies, accountability, and oversight aligned to SAMA requirements.
What must be in place?
How to stay compliant
Ensure all access and control decisions are tied to defined roles and responsibilities. Maintain records of ownership, approvals, and governance decisions to demonstrate accountability during regulatory assessments.
Key Control Objectives
What this requires
Organizations must establish a formal governance structure with defined policies, accountability, and oversight aligned to SAMA requirements.
What must be in place?
How to stay compliant
Ensure all access and control decisions are tied to defined roles and responsibilities. Maintain records of ownership, approvals, and governance decisions to demonstrate accountability during regulatory assessments.
Key Control Objectives
What this requires
Organizations must identify, assess, and continuously manage risks across systems, data, and operations.
What must be in place?
How to stay compliant
Maintain visibility into access across systems to identify risk exposure. Ensure access to critical systems is aligned with risk classification and continuously monitored for anomalies or misuse.
Key Control Objectives
What this requires
Access to systems and data must be controlled, role-based, and continuously validated.
What must be in place?
How to stay compliant
Ensure all access is approved, documented, and traceable. Maintain complete audit trails of access requests, approvals, and changes. Continuously review access to ensure it remains appropriate and aligned with job roles.
Key Control Objectives
What this requires
Organizations must continuously monitor systems and detect, respond to, and report cybersecurity incidents.
What must be in place?
How to stay compliant
Maintain continuous visibility into system access and activity. Ensure all access and system events are logged and monitored, and anomalies are detected early with proper response mechanisms.
Key Control Objectives
What this requires
Organizations must assess, control, and monitor risks introduced by vendors and external parties.
What must be in place?
How to stay compliant
Ensure third-party access is governed with the same rigor as internal access. Maintain visibility into vendor access, enforce role-based permissions, and monitor all third-party activity.
Key Control Objectives
What this requires
Sensitive financial and customer data must be protected against unauthorized access and misuse.
What must be in place?
How to stay compliant
Ensure access to sensitive data is limited based on role and necessity. Maintain logs of data access and ensure traceability of all actions to support audits and investigations.
Key Control Objectives
What this requires
Organizations must maintain maturity levels (minimum Level 3) and continuously improve cybersecurity controls.
What must be in place?
How to stay compliant
Continuously review access controls, risks, and system activity. Maintain historical evidence of control effectiveness and ensure controls evolve with emerging threats and regulatory expectations.
PLAYBOOK SECTION
SAMA Compliance Playbook
Build a structured approach to meet SAMA requirements and improve maturity.
Identify risks and control gaps
Implement governance and access controls
Maintain audit-ready monitoring and evidence
Disclaimer: This content is for informational purposes only and does not constitute legal or regulatory advice. Organizations should consult SAMA compliance experts for implementation.
