SAMA Compliance
Consulting

The SAMA Cyber Security Framework is the mandatory cyber security regulation issued by the Saudi Central Bank (SAMA) in May 2017 (version 1.0) for the financial entities it regulates. It defines controls across four domains — Cyber Security Leadership and Governance, Cyber Security Risk Management and Compliance, Cyber Security Operations and Technology, and Third Party Cyber Security — and measures compliance on a 0–5 maturity model. The framework is published on SAMA’s official rulebook (rulebook.sama.gov.sa) and is explicitly built on international standards including ISO 27001/27002, NIST, ISF, BASEL, and PCI DSS.

Per the framework’s own scope, member organisations are all banks, all insurance and reinsurance companies, all financing companies, and all credit bureaus operating in Saudi Arabia, plus the financial market infrastructure. Payment service providers licensed under SAMA’s payments regime are supervised against the same expectations in practice. The BCM Framework applies to the full scope of each member organisation, explicitly including subsidiaries, employees, subcontractors, and third parties — so your vendors and cloud providers are pulled into scope through the third-party domain.

The framework sets the baseline expectation that member organisations operate at maturity level 3 or higher on its 0–5 scale. Level 3 (“structured and formalised”) means controls are defined, approved, and implemented, and compliance with them is monitored — documentation alone is level 2 territory. Levels 4 and 5 add measured effectiveness and continuous improvement; many larger banks target them for critical domains. SAMA evaluates maturity through periodic self-assessments and supervisory reviews, and the cadence and depth of those reviews can vary by institution — treat specifics beyond the framework text as indicative.

The SAMA CSF is a supervisory regulation: sector-specific, mandatory for SAMA-regulated entities, assessed on a maturity scale, with no certificate at the end — SAMA supervises you continuously. ISO 27001 is a voluntary international standard you certify against once an accredited body audits your ISMS. Because the CSF was built on ISO 27001/27002 (among other standards), the two overlap heavily: one well-built ISMS produces the governance, risk, and control evidence both require. An ISO 27001 certificate is strong supporting evidence for SAMA supervision, but it does not replace your CSF obligations.

They are different regulators with different scopes. The National Cybersecurity Authority (NCA) issues the Essential Cybersecurity Controls (ECC-1:2018, updated as ECC-2:2024) as the kingdom-wide baseline for government entities, critical national infrastructure, and — under the 2024 update — a broader set of organisations. SAMA’s CSF is the financial-sector regime and is more prescriptive in areas like governance, risk management, and third-party security. A SAMA-regulated institution treats the CSF as its primary cyber regulation and maps to the ECC where NCA applicability also extends to it; we build one control set mapped to both so nothing is implemented twice.

For a typical financing company, insurer, or payment provider starting from partial maturity, plan on 10–16 weeks of consulting work to reach a defensible level-3 posture: scoping and gap assessment, ISMS/BCMS documentation, control implementation, and assurance. Engagements are custom-scoped to your size, regulator deadlines, and existing maturity — we provide a fixed, all-inclusive quote after a short scoping call (in SAR or USD for Gulf engagements), with no hourly billing and no scope creep. Large banks with complex estates take longer. ISO 27001/22301 certification-body fees, if you choose to certify, are billed separately. TCSA is an independent consultancy — we prepare and implement; SAMA supervises. We are not affiliated with, or endorsed by, the Saudi Central Bank.