What Is the SAMA Cyber Security Framework?
SAMA established the Framework to create a common approach for regulated financial institutions, achieve appropriate cybersecurity maturity and ensure cyber risks are managed. It is principle/risk based and contains objectives and mandated control considerations.
The SAMA Rulebook lists the 2017 Cyber Security Framework as In-Force. SAMA can issue additional current circulars and sector requirements, so implementation teams should work from the live Rulebook rather than a copied historical PDF alone.
Scope and Applicability
The Framework applies to SAMA-regulated member organizations within its stated scope, including banking, finance, payment systems/service providers, credit bureaus and other regulated categories/circulars. Sector-specific exceptions and additional directions can affect individual subdomains.
Its scope covers information, applications/services/databases, computers/electronic machines, storage, premises/equipment and communication networks, and includes relevant third-party considerations.
The Four Domains
| Domain | Focus |
|---|---|
| Leadership and Governance | Board/senior oversight, governance, strategy, policy, roles |
| Risk Management and Compliance | Risk identification/treatment and compliance |
| Operations and Technology | Operational/technical protective and detective controls |
| Third Party Cyber Security | Outsourced and supplier cyber risk |
Preserve the framework hierarchy from domain to subdomain, objective and control consideration so evidence remains traceable.
SAMA Maturity Model 0–5
| Level | Definition |
|---|---|
| 0 | Non-existent |
| 1 | Ad-hoc |
| 2 | Repeatable but informal |
| 3 | Structured and formalized |
| 4 | Managed and measurable |
| 5 | Adaptive |
Higher maturity levels are cumulative. Level 4 adds measurement/evaluation with KPIs/KRIs; Level 5 integrates continual improvement and broader risk intelligence.
Why Level 3 Matters
The Framework states member organizations should at least operate at Maturity Level 3 or higher. At Level 3, controls are defined, approved, implemented and demonstrable.
SAMA describes a documentation pyramid: policy explains why; standards define what must be implemented; procedures explain how. Documentation alone is insufficient—the organization must demonstrate operation.
Self-Assessment and Audit
The Framework requires periodic self-assessment using the maturity model and states that SAMA reviews/audits implementation to determine compliance and maturity. Build recurring evidence from technical systems, reviews, incidents and third-party governance rather than recreating evidence immediately before assessment.
Implementation Roadmap
- Confirm current Rulebook/circular applicability.
- Establish board/senior governance and cyber-function ownership.
- Map controls to domains/subdomains.
- Assess current maturity.
- Prioritize gaps preventing Level 3.
- Formalize policy/standards/procedures.
- Implement controls and automated evidence.
- Define KPIs/KRIs as maturity advances.
- Perform periodic self-assessment/remediation.
- Track current circulars and waivers/compensating controls.
Third-Party Cyber Security
Third-party security is a top-level domain. Inventory providers, assess risk before contracting, define security requirements, control remote access/data sharing and monitor continuing performance. Cloud/API dependencies should be mapped to data classifications and critical services.
APIs and SAMA
Digital banking, payments, fintech and partners depend on APIs. Inventory, authentication/authorization, encryption, gateway configuration, secure development, monitoring and incident response should tie to applicable operations/technology and third-party controls.
Related Ammune reading: Open banking API security and Fintech cybersecurity.
Moving From Level 3 to Measurable Maturity
Level 3 is the Framework’s practical minimum because controls are structured, approved and demonstrable. Moving toward Level 4 requires more than collecting dashboards: measurement should show whether controls are effective and whether cyber risk is trending in the intended direction.
Choose indicators that connect to control objectives. Patch compliance percentage is useful, but time-to-remediate critical internet-facing vulnerabilities may be more meaningful. Counting access reviews says little about quality unless exceptions and removals are tracked. Security operations can measure detection coverage, response time and recurring root causes rather than raw alert volume.
| Area | Example KPI/KRI |
|---|---|
| Vulnerability management | Critical remediation time, overdue high-risk assets |
| Identity/access | Privileged review completion and unresolved exceptions |
| Security monitoring | Coverage of critical assets/use cases and detection gaps |
| Third parties | High-risk providers overdue for reassessment/remediation |
| Incident response | Detection/containment time and repeated causes |
| API security | Known API inventory coverage, critical runtime findings, unresolved exposures |
Metrics should support management decisions. If a metric is always green because it measures activity rather than risk/effectiveness, it is unlikely to support Level 4 maturity.
Level 3 Baseline vs Sector-Specific Level 4 Requirements
The Framework’s general statement that member organizations should operate at least at Level 3 is only the starting point. SAMA can impose stronger requirements through sector-specific circulars. A notable 2019 banking instruction required banks to develop a roadmap to achieve Maturity Level 4 for specified subdomains.
A compliance matrix should therefore include a source column for every requirement: core CSF, banking/insurance/payment circular or another current SAMA instruction. Do not build a regulated entity’s target-state plan solely from the generic Level 3 paragraph.
Level 4 also changes the evidence expectation: effectiveness is periodically measured and evaluated, results are documented and KRIs/trend reporting are used to identify improvements. That is materially different from Level 3’s structured/formalized implementation.
SAMA Cybersecurity Evidence by Maturity Stage
| Maturity focus | Evidence emphasis |
|---|---|
| Level 2 — repeatable/informal | Recurring practices exist but may lack formal approval, consistency or complete documentation |
| Level 3 — structured/formalized | Approved policies, standards/procedures and demonstrable implementation |
| Level 4 — managed/measurable | Periodic control-effectiveness measurement, KRIs, trend analysis and documented evaluation |
| Level 5 — adaptive | Continuous improvement informed by risk, performance and changing threat/environment context |
This prevents a common maturity mistake: collecting more documents and calling that higher maturity. The transition from Level 3 toward Level 4 is primarily about measuring whether controls work and using that evidence to manage cyber risk.
SAMA CSF Checklist
- Use current in-force Rulebook/circulars.
- Confirm scope/exceptions.
- Map the four domains.
- Assess maturity 0–5.
- Prioritize at least Level 3.
- Maintain approved policy/standards/procedures.
- Define implementation KPIs and effectiveness KRIs.
- Perform periodic self-assessment.
- Govern third parties/remote access.
- Include APIs/cloud services.
- Document compensating controls/waivers.
Frequently Asked Questions
Is the SAMA Framework still in force?
Yes. The SAMA Rulebook lists it as In-Force; organizations should also review current circulars.
How many domains are there?
Four main domains.
How many maturity levels?
Six, numbered 0 through 5.
What maturity level is expected?
The Framework states member organizations should at least operate at Level 3 or higher.
Does SAMA review assessments?
The Framework states member organizations perform periodic self-assessment and SAMA reviews/audits implementation.
Primary References
Add API Runtime Evidence to Your SAMA CSF Program
Connect API discovery and runtime monitoring to the governance, operations, risk and third-party evidence required by the SAMA Cyber Security Framework.