SAMA Cyber Security Framework: What It Is and Who It Applies To
The SAMA Cyber Security Framework is a framework issued by the Saudi Central Bank (SAMA) to help the financial institutions it regulates identify and address cyber security risks. SAMA's Rulebook says it is mandated by SAMA and applies to banks, insurance and reinsurance companies, financing companies, credit bureaus and financial market infrastructure operating in Saudi Arabia. Member organisations assess themselves against it, and SAMA reviews and audits the results.
What is the SAMA Cyber Security Framework?
It is a cyber security framework that SAMA established "to enable Financial Institutions regulated by SAMA" (which it calls Member Organizations) to identify and address cyber security risks effectively. The Rulebook says Member Organizations "must adopt the Framework", and that SAMA owns it and is responsible for updating it periodically.
It was issued under Circular No. 381000091275, dated 28/8/1438H (24 May 2017), and the Rulebook lists its status as "In-Force". It states three objectives:
- a common approach to cyber security across Member Organizations;
- an appropriate maturity level of cyber security controls; and
- properly managed cyber security risks.
SAMA says the framework is based on its own requirements and on industry standards "such as NIST, ISF, ISO, BASEL and PCI", and that it supersedes all earlier SAMA circulars on cyber security (Appendix A lists them). Business continuity requirements sit in a separate SAMA document, the Business Continuity Minimum Requirements.
Who must follow the SAMA Cyber Security Framework?
All Member Organizations regulated by SAMA. Section 1.4 says this includes:
- all banks operating in Saudi Arabia;
- all insurance and/or reinsurance companies operating in Saudi Arabia;
- all financing companies operating in Saudi Arabia;
- all credit bureaus operating in Saudi Arabia; and
- the financial market infrastructure.
All domains apply to banks. For other financial institutions the framework lists exceptions: it excludes sub-domains 3.2.3 (compliance with industry standards), 3.3.12 (payment systems) and 3.3.13 (electronic banking services), with conditions in some cases. For example, an organisation that stores, processes or transmits cardholder data or deals with SWIFT services should still implement the PCI standard and/or the SWIFT Customer Security Controls Framework.
The Rulebook also tags the document with other sectors, such as payment systems and payment services providers. Check the exact position with SAMA or a Saudi legal adviser. This page is general information, not legal advice.
A technology supplier to a Member Organization is not itself listed. But the framework's third-party controls expect Member Organizations to address cyber security in vendor contracts, outsourcing and cloud arrangements (see below).
How is the framework structured?
Around four main domains:
- Cyber Security Leadership and Governance
- Cyber Security Risk Management and Compliance
- Cyber Security Operations and Technology
- Third Party Cyber Security
Each domain has sub-domains, such as governance, strategy, policy, risk management, identity and access management, cryptography, incident management, threat management, vulnerability management, and cloud computing. For each sub-domain the framework states a principle, an objective and "control considerations", which it describes as the mandated controls that should be considered.
It is "principle based, also referred to as risk based". Where a control consideration cannot be implemented, a Member Organization should consider compensating controls, an internal risk acceptance and a formal waiver request to SAMA (Appendix D sets the process). Some examples of the wording:
- 3.1.1 says the organisation should ensure its CISO is Saudi, sufficiently qualified, and obtain SAMA's no objection to the appointment.
- 3.2.4 says customer-facing and internet-facing services should be subject to annual review and penetration tests.
What do the maturity levels mean?
The framework measures cyber security maturity on six levels, 0 to 5: non-existent, ad-hoc, repeatable but informal, structured and formalized, managed and measurable, and adaptive. To reach levels 3, 4 or 5, an organisation must first meet all criteria of the earlier levels.
SAMA says Member Organizations "should at least operate at maturity level 3 or higher". At level 3, controls are defined, approved and implemented, can be demonstrated, are backed by policies, standards and procedures, and are tracked with key performance indicators. The text says compliance with that documentation is monitored, "preferably using a governance, risk and compliance tool (GRC)".
Level 4 adds measuring effectiveness with key risk indicators, and level 5 adds continuous improvement. The Rulebook notes that banks have additional level 4 requirements under a later SAMA circular, which this page does not cover.
How does SAMA assess compliance?
Through periodic self-assessment, then SAMA review. The framework says implementation "will be subject to a periodic self-assessment", performed by the Member Organization using a questionnaire. SAMA reviews and audits the self-assessments to determine the level of compliance and the maturity level. The framework also says it will be used to compare Member Organizations with one another.
Separately, section 3.2.5 expects independent, regular cyber security audits under generally accepted auditing standards and the framework. The document describes no certificate.
What does it expect when a bank uses vendors, outsourcing or cloud?
Sub-domain 3.4 covers third parties. Some of the wording:
- Contracts and vendors (3.4.1): a cyber security risk assessment during procurement, defined requirements in tenders, an incident escalation process, exit requirements, and the right to perform cyber security reviews and audits.
- Outsourcing (3.4.2): involvement of the cyber security function and SAMA approval prior to material outsourcing.
- Cloud computing (3.4.3): for hybrid and public cloud, due diligence on the provider and SAMA approval before using cloud services or signing the contract. In principle only cloud services located in Saudi Arabia should be used, or explicit SAMA approval obtained for services outside it.
How does the framework relate to other standards and Saudi instruments?
Section 3.2.3 says Member Organizations should comply with PCI-DSS, the EMV technical standard and the SWIFT Customer Security Controls Framework (March 2017). See the PCI DSS page for that standard.
The framework is a separate document from NCA's controls (see NCA ECC), and from Saudi Arabia's personal data law (see Saudi PDPL). Each has its own scope text, so read each one. For the wider picture of risk and control frameworks, see NIST CSF 2.0 and ISO 27001.
Is the SAMA Cyber Security Framework mandatory?
The Rulebook says the framework is mandated by SAMA, and that Member Organizations "must adopt" it. It applies to the SAMA-regulated institutions listed in section 1.4.
Who does the framework apply to?
Banks, insurance and reinsurance companies, financing companies, credit bureaus and financial market infrastructure operating in Saudi Arabia. Non-bank institutions have listed exceptions.
Is there a SAMA cyber security certificate?
The framework describes periodic self-assessment, reviewed and audited by SAMA, to determine compliance and maturity level. It does not describe a certificate.
What maturity level should organisations reach?
SAMA says Member Organizations should at least operate at maturity level 3 or higher, on a scale of 0 to 5.
How many domains does it have?
Four: Cyber Security Leadership and Governance, Cyber Security Risk Management and Compliance, Cyber Security Operations and Technology, and Third Party Cyber Security.
When was it issued?
Under circular dated 28/8/1438H, which is 24 May 2017. The Rulebook lists it as in force, and SAMA reviews it periodically, so check the Rulebook for the current version.
Talk to a practitioner
Tell us the obligation you are trying to meet and who is asking for it. The first call is with a practitioner.