Skip to main content
Comply with the Saudi Central Bank’s cybersecurity framework for financial institutions.
The Saudi Arabian Monetary Authority (now Saudi Central Bank, SAMA) Cyber Security Framework is a mandatory framework for financial institutions regulated by SAMA. It defines cybersecurity requirements across governance, risk management, operations, and third-party security to protect the Kingdom’s financial sector.
The SAMA CSF is mandatory for banks, insurance companies, and other financial institutions regulated by the Saudi Central Bank.

​
Who needs SAMA Cyber Security Framework?

Saudi financial institutions

Banks, insurers, and finance companies regulated by SAMA.

Fintech and payment firms

Payment service providers and fintechs operating in Saudi Arabia.

​
Key components

Cyber security governance

Leadership oversight, strategy, and a defined cybersecurity organization.

Risk management

Identification and treatment of cybersecurity risks.

Operations & technology

Security operations, identity management, and infrastructure protection.

Third-party security

Management of cybersecurity risk from vendors and partners.

​
How DSALTA helps with SAMA Cyber Security Framework

1

Activate SAMA CSF

Select the SAMA framework from the Frameworks page. DSALTA maps its domains to controls.
2

Review mapped controls

Review governance, risk, and operations controls and assign owners.
3

Collect evidence automatically

Connect integrations to gather technical evidence.
4

Approve policies

Review and approve policies aligned with SAMA requirements.
5

Track maturity

Monitor your maturity level against the framework’s expectations.

​
Frequently asked questions

All financial institutions regulated by the Saudi Central Bank, including banks, insurers, and finance companies.
Yes. SAMA assesses institutions against maturity levels, expecting continuous improvement over time.