SAMA Cybersecurity Framework

Saudi Central Bank Cybersecurity Framework - Leadership, Risk, Resilience domains for financial sector.


Short name	SAMA CSF
Region	Middle East & Africa
Country or scope	Saudi Arabia
Sector	Finance
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers SAMA CSF

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for SAMA CSF.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for SAMA CSF and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`SA-SAMA-ASSET` Asset Management and Inventory	Member organisations must maintain an accurate and complete inventory of information assets, which for applications includes the software components they are built from (SAMA CSF Operations & Technology domain, asset management subdomain)	Scan
`SA-SAMA-VULN` Vulnerability Management	A vulnerability management process must ensure weaknesses in technology are identified and remediated in a timely manner, which requires version-level knowledge of all deployed components (SAMA CSF Operations & Technology domain, vulnerability management subdomain)	Scan
`SA-SAMA-D4` Third Party Cyber Security	Cyber security requirements must be enforced across outsourcing and supplier relationships, so the provenance and supplier of software components must be documented (SAMA CSF Domain 4, Third Party Cyber Security)	Scan
`SA-SAMA-INT` Application and Infrastructure Integrity	Security standards for applications and infrastructure must protect against unauthorised modification, which is evidenced by cryptographic integrity hashes on software artifacts (SAMA CSF Operations & Technology domain, application/infrastructure security subdomains)	Scan
`SA-SAMA-D2` Cyber Risk Identification	The cyber security risk management process must identify risks across information assets, which requires that assets and their components be unambiguously identifiable (SAMA CSF Domain 2, Cyber Security Risk Management and Compliance)	Scan
`SA-SAMA-DOC` Documented Security Baseline	Cyber security documentation must be maintained, current and traceable, which for software estates means identifiable, timestamped bills of materials (SAMA CSF governance and documentation requirements)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`SAMA-1.1`	Cyber Governance Framework Establishment
`SAMA-1.2`	Cybersecurity Strategy & Policy
`SAMA-2.1`	Cyber Risk Management Process
`SAMA-2.2`	Cyber Risk Register
`SAMA-3.1`	Security Operations & Monitoring
`SAMA-3.2`	Vulnerability & Patch Management
`SAMA-3.3`	Identity & Access Management
`SAMA-4.1`	Third-Party Cyber Risk Assessment
`SAMA-4.2`	Third-Party Contractual Security Requirements
`SAMA-4.4`	Third-Party Ongoing Monitoring

Policy templates

Written for SAMA CSF:

SAMA CSF Cyber Governance Charter
SAMA Third-Party Cybersecurity Management Procedure

And 22 from the standard set, adapted to SAMA CSF.