# SAMA CSF: Saudi Central Bank Cyber Security Framework

> The cyber security framework for banks, insurers and finance companies regulated by the Saudi Central Bank.

URL: https://securei3.com/standards/sama-csf/
Category: GCC regulations: Law or regulation
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


The SAMA Cyber Security Framework organises requirements into domains covering leadership and governance, risk management and compliance, operations and technology, and third-party security. We run maturity assessments, build remediation roadmaps and help prepare evidence for supervisory reviews.

## Who it is for

- Banks, insurers and finance companies in Saudi Arabia
- Fintechs licensed or sandboxed by SAMA
- Technology vendors to SAMA-regulated institutions

## Benefits

- Reach and evidence the required maturity level
- Clear roadmap for board reporting
- Aligned with ISO 27001 and ISO 22301

## How Secure iQube helps

1. **Applicability and scoping**: Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
2. **Data and process mapping**: Build a record of processing or control inventory so obligations can be tied to real systems and owners.
3. **Gap assessment**: Measure current practice against each obligation and rank the gaps by legal and business risk.
4. **Remediation roadmap**: Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
5. **Evidence and ongoing monitoring**: A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.

## Frequently asked questions

### What maturity level does SAMA expect?

SAMA’s framework uses maturity levels from 0 to 5; regulated organisations are expected to reach at least level 3, controls defined, approved and implemented consistently.

Related: https://securei3.com/standards/nca-ecc/, https://securei3.com/standards/iso-27001/, https://securei3.com/standards/iso-22301/, https://securei3.com/standards/ksa-pdpl/

Contact: https://securei3.com/contact/: info@securei3.com