# SAMA Cyber Security Framework (CSF)

**Version 1.0 (May 2017)** — issued by the Saudi Central Bank (SAMA); the operative cybersecurity baseline for the financial sector.

## Who it binds
All SAMA-regulated entities: banks, insurance/reinsurance companies, financing companies, credit bureaus, and licensed fintechs.

## Structure
**4 domains:**
1. **Cyber Security Leadership & Governance** — strategy, policy, roles, awareness, training
2. **Cyber Security Risk Management & Compliance** — risk methodology, compliance, audit
3. **Cyber Security Operations & Technology** — asset/identity/infrastructure security, secure development, monitoring, incident management, BCM integration
4. **Third-Party Cyber Security** — outsourcing, cloud, supplier assurance

## Maturity model
**Six levels (0–5)**: 0 Non-existent → 1 Ad-hoc → 2 Repeatable but informal → 3 **Structured & formalized** → 4 Managed & measurable → 5 Adaptive. SAMA expects regulated entities to operate at **maturity level 3 minimum** (defined, approved, implemented processes), with periodic self-assessments and SAMA reviews.

## Adjacent SAMA frameworks (route, don't deep-dive)
- **IT Governance Framework** — IT governance/management controls alongside CSF
- **Business Continuity Management Framework** — resilience requirements
- **Cyber Threat Intelligence Principles (2022)** — CTI capability expectations

## NCA interplay
Banks and financial-market infrastructure designated **CNI** also fall under NCA ECC — the regimes stack. Practical approach: maintain one control framework internally, mapped to both SAMA CSF and ECC, and report to each regulator per its mechanics. Where requirements appear to conflict, satisfy the stricter and document the mapping; the exact deconfliction protocol between SAMA and NCA is not published — advise engaging both regulators rather than assuming.