The Saudi Central Bank (SAMA) IT Governance Framework sets expectations for IT governance, IT risk management and IT operations in SAMA-regulated institutions. Like the SAMA Cyber Security Framework, it uses maturity levels, and institutions are expected to reach and evidence the required level.
We assess your current maturity, design the governance and processes needed, and prepare the evidence for SAMA reviews, joined up with your Cyber Security Framework and business continuity work.
Who it is for
- Banks, insurers and finance companies regulated by SAMA
- Payment service providers and fintechs licensed by SAMA
- IT providers supporting SAMA-regulated institutions
What you gain
- A maturity level you can defend to SAMA
- IT governance that links with the SAMA Cyber Security Framework
- Clear roles, policies and metrics for IT
How we get you compliant
Applicability and scoping
Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
Data and process mapping
Build a record of processing or control inventory so obligations can be tied to real systems and owners.
Gap assessment
Measure current practice against each obligation and rank the gaps by legal and business risk.
Remediation roadmap
Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
Evidence and ongoing monitoring
A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.