What the SAMA framework is
The Saudi Central Bank (SAMA) Cyber Security Framework sets cybersecurity requirements for organisations it regulates — banks, insurers, finance companies and payment providers operating in Saudi Arabia.
The four domains
- Cyber Security Leadership and Governance
- Cyber Security Risk Management and Compliance
- Cyber Security Operations and Technology
- Third-Party Cyber Security
Maturity levels
Institutions are assessed on a maturity model from Level 0 (non-existent) to Level 5 (adaptive). SAMA expects regulated organisations to reach at least Level 3 — controls that are defined, documented, approved and consistently implemented.
How to prepare
- Run a self-assessment against every control and record the current maturity
- Close documentation gaps first — many Level 3 failures are missing approvals or records
- Align with NCA ECC where both apply to avoid duplicate work
- Keep evidence organised by domain and subdomain
How muVerity helps
We run SAMA maturity self-assessments, build remediation roadmaps and organise evidence across SAMA and NCA ECC together.