Home / Controls lists / SAMA Cyber Security Framework

SAMA Cyber Security Framework Controls List

SAMA's framework sets cyber security controls for the financial institutions it supervises. Section 3 holds four domains: leadership and governance, risk management and compliance, operations and technology, and third parties. Each subdomain has a principle, an objective and numbered control considerations; this list follows that numbering.

Download SAMA CSF controls list (Excel) Read the list

Free account needed to download. You come straight back to the file.

Who it is for. Banks, insurance and reinsurance companies, financing companies, credit bureaus and financial market infrastructure operating in Saudi Arabia, which the framework calls Member Organizations. Banks apply every domain; the other institutions are excused from some subdomains.

What this list covers. Version 1.0, May 2017 (SAMA circular 381000091275 of 24 May 2017), read from the PDF and the SAMA Rulebook copy on rulebook.sama.gov.sa; we found no later version, but SAMA can update the framework and add circulars, so check the Rulebook for changes: 285 controls. Each has a reference, a heading and a sentence in plain English.

Read it here, download it when you want it. The download is the SecureXcel unified controls workbook for this framework, an Excel file exactly as we maintain it, with a Version History sheet for document control.

3.1.1. Leadership: Cyber security governance

Ref	Control	What it requires
3.1.1-1	Board-mandated cyber security committee	Set up a cyber security committee and have the board give it a formal mandate to direct cyber security across the organisation.
3.1.1-2	Independent committee chair	Have an independent senior manager from a control function chair the committee.
3.1.1-3	Who sits on the committee	Seat senior managers from the relevant departments (such as operations, IT, compliance and the business) plus the CISO. Internal audit may attend as an observer.
3.1.1-4	Committee charter	Write and approve a charter that sets the committee's objectives, roles, the minimum number of people at a meeting and how often it meets, which must be at least quarterly.
3.1.1-5	Cyber security function	Establish a dedicated cyber security function in the organisation.
3.1.1-6	Separate from IT	Keep the cyber security function independent of IT, with its own reporting line, budget and staff evaluations, so the two cannot be in conflict of interest.
3.1.1-7	Reporting line to the top	Have the cyber security function report straight to the CEO or managing director, or to the general manager of a control function.
3.1.1-8	Full-time CISO	Appoint a full-time senior manager to lead the function, with the title of chief information security officer.
3.1.1-9	CISO eligibility and SAMA no-objection	Make sure the CISO is a Saudi national and properly qualified, and get SAMA's no-objection before assigning the person to the role.
3.1.1-10	Budget for cyber security	Have the board set aside enough budget to carry out the cyber security activities the framework calls for.

3.1.2. Leadership: Cyber security strategy

Ref	Control	What it requires
3.1.2-1	Own a cyber security strategy	Define, approve, maintain and carry out a cyber security strategy.
3.1.2-2	Align the strategy	Line the strategy up with the organisation's overall objectives, its legal and regulatory duties and the banking sector's cyber security strategy.
3.1.2-3	What the strategy covers	State why cyber security matters to the organisation, the future state needed to stay resilient to emerging threats, and which initiatives will be delivered, and when, to get there.

3.1.3. Leadership: Cyber security policy

Ref	Control	What it requires
3.1.3-1	Approve and communicate the policy	Define a cyber security policy, have it approved and tell the people it affects.
3.1.3-2	Review the policy on a schedule	Review the policy regularly under a set review process rather than only when something goes wrong.
3.1.3-3	How the policy is built and used	Make the policy feed other corporate policies (HR, finance, IT), rest on detailed standards and procedures, draw on best practice and recognised standards, and reach stakeholders.
3.1.3-4	What the policy contains	Cover a definition of cyber security, objectives and scope, the board's intent, responsibilities and links to standards, plus rules on classification, asset owners, risk assessment, awareness, compliance, breach reporting and continuity.

3.1.4. Leadership: Cyber security roles and responsibilities

Ref	Control	What it requires
3.1.4-1	Board accountability	The board carries ultimate responsibility: it funds cyber security, approves the committee charter and endorses the governance, strategy and policy once the committee has approved them.
3.1.4-2	Committee duties	The committee keeps the risk appetite current, reviews strategy against business goals, and approves and tracks governance, strategy, policy, programmes, the risk process and the KRIs and KPIs.
3.1.4-3	Senior management duties	Senior management makes standards and processes reflect security needs, makes sure people accept the policy and its supporting rules, and writes security duties into key job descriptions.
3.1.4-4-a	CISO owns the core documents	The CISO develops and maintains the cyber security strategy, policy, architecture and risk management process.
3.1.4-4-b	CISO ensures standards exist	The CISO makes sure detailed security standards and procedures are written, approved and put into use.
3.1.4-4-c to d	Risk-based solutions and staff growth	The CISO delivers risk-based solutions spanning people, process and technology, and builds the skills of the security team to deliver them in a business context.
3.1.4-4-e	CISO runs security activities	The CISO covers SOC monitoring, compliance monitoring, oversight of incident investigations, threat intelligence from internal and external sources, and cyber security reviews.
3.1.4-4-f	CISO assesses risk on assets	The CISO carries out cyber security risk assessments on the organisation's information assets.
3.1.4-4-g	CISO supports other functions	The CISO helps other functions by classifying information and systems, setting security requirements for important projects and performing security reviews.
3.1.4-4-h	CISO runs awareness programmes	The CISO defines and carries out the cyber security awareness programmes.
3.1.4-4-i	CISO measures and reports	The CISO measures and reports KRIs and KPIs on strategy, policy compliance, standards and procedures, and programmes such as awareness and data classification.
3.1.4-5	Internal audit duty	Internal audit is responsible for carrying out cyber security audits.
3.1.4-6	Every staff member's duty	All staff must comply with the cyber security policy, standards and procedures.

3.1.5. Leadership: Cyber security in project management

Ref	Control	What it requires
3.1.5-1	Build security into project method	Fold cyber security into the project management methodology, so security risks are found and dealt with as part of every project.
3.1.5-2-a to b	Security goals and early involvement	Put cyber security objectives into project objectives, and bring the cyber security function into every phase of a project.
3.1.5-2-c to d	Project risk assessment and register	Assess cyber security risk at project start, confirm needs are met by existing or new controls, and log the risks in the project risk register and track them.
3.1.5-2-e to f	Project ownership and review	Assign cyber security responsibilities in each project and have an independent internal or external party perform a cyber security review.

3.1.6. Leadership: Cyber security awareness

Ref	Control	What it requires
3.1.6-1	Run awareness programmes	Define, approve and run awareness programmes that build a positive cyber security culture.
3.1.6-2	Cover staff, third parties and customers	Run an awareness programme for each of three groups: your own staff, your third parties and your customers.
3.1.6-3	Target behaviour, tailor by audience	Aim the programme at changing behaviour, tailoring it to each audience and using several channels.
3.1.6-4	Keep awareness going all year	Run awareness activities regularly and throughout the year rather than as a one-off.
3.1.6-5	Minimum awareness content	Cover the security measures in place, people's roles and duties, and current threats and events such as spear-phishing and whaling.
3.1.6-6	Evaluate the programme	Measure how well the awareness activities work and draw up recommendations to improve the programme.
3.1.6-7	Customer awareness content	Address retail and commercial customers, and at least list the security measures customers can adopt to reduce their own risk.

3.1.7. Leadership: Cyber security training

Ref	Control	What it requires
3.1.7-1	Role-based security training	Give specialist or security-related training that fits job descriptions to key roles, the cyber security team, people who build and maintain assets and people who run risk assessments.
3.1.7-2	Training for secure operation	Educate staff so they have the skills and knowledge to operate the organisation's information assets securely.

3.2.1. Risk: Cyber security risk management

Ref	Control	What it requires
3.2.1-1	Risk management process	Define, approve and put in place a cyber security risk management process.
3.2.1-2	Protect confidentiality, integrity, availability	Aim the process at safeguarding the confidentiality, integrity and availability of information assets.
3.2.1-3	Align with enterprise risk	Align the cyber security risk process with the organisation's existing enterprise risk management process.
3.2.1-4	Document the four stages	Write the process down so it covers identification, analysis, response, and monitoring and review of risk.
3.2.1-5	Cover all asset types	Apply the process to business processes, business applications and infrastructure components, and to other information assets.
3.2.1-6	When to start a risk assessment	Start the process early in a project, before critical changes, when outsourcing is being considered and when launching new products or technologies.
3.2.1-7	Reassess existing assets	Re-run risk assessments on existing information assets on a schedule driven by their classification or risk profile.
3.2.1-8	Involve the right people	Involve business owners, IT specialists, cyber security specialists and representatives of key users in risk work.
3.2.1-9	Report results to the risk owner	Report each risk assessment's result to the relevant business owner, who is the risk owner.
3.2.1-10	Risk owner accepts the results	Have the risk owner accept and endorse the assessment results.
3.2.1-11	Define risk appetite and tolerance	Define the organisation's cyber security risk appetite and tolerance clearly and have them formally approved.

3.2.1.1. Risk: Cyber security risk identification

Ref	Control	What it requires
3.2.1.1-1	Identify risks	Carry out cyber security risk identification.
3.2.1.1-2	Central risk register	Record the identified risks, ideally in a central register.
3.2.1.1-3	What identification covers	Take in relevant information assets, threats, vulnerabilities and the key controls already in place.

3.2.1.2. Risk: Cyber security risk analysis

Ref	Control	What it requires
3.2.1.2-1	Analyse the risks	Carry out a cyber security risk analysis.
3.2.1.2-2	Impact and likelihood	Judge the potential business impact of each risk and how likely the threat event is to happen.

3.2.1.3. Risk: Cyber security risk response

Ref	Control	What it requires
3.2.1.3-1	Treat risks within appetite	Treat the relevant risks in line with the organisation's risk appetite and cyber security requirements.
3.2.1.3-2	Document treatment options	Keep a documented list of treatment options: accept, avoid, transfer or mitigate the risk with controls.
3.2.1.3-3	Accepting a risk	Check accepted risks against set limits. The business owner signs off, confirming the risk is within appetite, reported to the committee and does not conflict with SAMA regulations.
3.2.1.3-4	Avoiding a risk	Have a business owner decide to cancel or postpone an activity or project that brings an unacceptable risk.
3.2.1.3-5	Transferring or sharing a risk	Share the risk with relevant internal or external providers, get their acceptance and make sure the risk is actually transferred or shared.
3.2.1.3-6	Mitigating with controls	Identify suitable controls, weigh their strengths, weaknesses, cost, feasibility and compliance fit, select them, and have the business owner sign off residual risk.
3.2.1.3-7	Risk treatment plan	Record risk treatment actions in a risk treatment plan.

3.2.1.4. Risk: Cyber risk monitoring and review

Ref	Control	What it requires
3.2.1.4-1	Monitor treatment progress	Track progress against the treatment plan and check that the agreed controls are being implemented.
3.2.1.4-2	Review control effectiveness	Review the design and effectiveness of new or revised controls.

3.2.2. Risk: Regulatory compliance

Ref	Control	What it requires
3.2.2-1	Track cyber security regulation	Run a process that keeps the organisation compliant with regulations affecting cyber security. Run it periodically and when new rules take effect, involve key areas and update policy, standards and procedures.

3.2.3. Risk: Compliance with industry standards

Ref	Control	What it requires
3.2.3-1-a	Comply with PCI-DSS	Meet the Payment Card Industry Data Security Standard.
3.2.3-1-b	Comply with EMV	Meet the EMV technical standard (Europay, MasterCard and Visa).
3.2.3-1-c	Comply with SWIFT controls	Meet the SWIFT Customer Security Controls Framework, in its March 2017 edition as named by the framework.

3.2.4. Risk: Cyber security review

Ref	Control	What it requires
3.2.4-1	Review critical assets periodically	Run cyber security reviews of critical information assets on a regular cycle.
3.2.4-2	Annual review and testing of online services	Review customer-facing and internet-facing services every year and subject them to penetration tests.
3.2.4-3	Record review details	Record the results, issues found and recommended actions of each review.
3.2.4-4	Report to the business owner	Report the review results to the business owner.
3.2.4-5	Follow-up reviews	Follow up to check that issues are addressed, critical risks are effectively treated and agreed actions are managed on an ongoing basis.

3.2.5. Risk: Cyber security audits

Ref	Control	What it requires
3.2.5-1	Independent audits to recognised standards	Have cyber security audits done independently, following generally accepted auditing standards and the SAMA framework.
3.2.5-2	Audit manual and plan	Perform the audits according to the organisation's audit manual and audit plan.

3.3.1. Operations: Human resources

Ref	Control	What it requires
3.3.1-1	Security in HR processes	Define, approve and put in place cyber security requirements inside human resources processes.
3.3.1-2	Measure the HR process	Monitor, measure and periodically evaluate how well the HR process works for security.
3.3.1-3-a	Security terms in staff agreements	Put cyber security responsibilities and non-disclosure terms in staff agreements, covering both the period of employment and after it.
3.3.1-3-b	Awareness at joining and during employment	Give staff cyber security awareness when they start and throughout their employment.
3.3.1-3-c	Disciplinary action	Say when disciplinary action applies to security breaches.
3.3.1-3-d	Screening and background checks	Screen staff and run background checks.
3.3.1-3-e	Leaving the organisation	On exit, revoke access rights and recover assigned assets such as badges, tokens, mobile devices and all electronic and physical information.

3.3.2. Operations: Physical security

Ref	Control	What it requires
3.3.2-1	Physical security process	Define, approve and put in place a physical security process.
3.3.2-2	Measure the physical process	Monitor, measure and periodically evaluate the physical security process.
3.3.2-3-a	Physical entry controls	Control who enters facilities, including visitors.
3.3.2-3-b	Monitoring and surveillance	Use monitoring such as CCTV, GPS tracking for ATMs and sensitivity sensors.
3.3.2-3-c	Data centres and data rooms	Protect data centres and data rooms.
3.3.2-3-d	Environmental protection	Protect equipment from environmental hazards.
3.3.2-3-e	Assets through their lifecycle	Protect information assets through their life, including transport and secure disposal, to avoid unauthorised access and data leakage.

3.3.3. Operations: Asset management

Ref	Control	What it requires
3.3.3-1	Asset management process	Define, approve and put in place an asset management process.
3.3.3-2	Measure the asset process	Monitor, measure and periodically evaluate the asset management process.
3.3.3-3-a	One unified asset register	Keep a single, unified, accurate and current register of information assets.
3.3.3-3-b	Ownership and custodianship	Record an owner and a custodian for every information asset.
3.3.3-3-c	Link to dependent processes	Reference the other processes that depend on asset management.
3.3.3-3-d	Classify, label and handle	Classify, label and handle information assets according to their classification.
3.3.3-3-e	Discover new assets	Discover new information assets as they appear.

3.3.4. Operations: Cyber security architecture

Ref	Control	What it requires
3.3.4-1	Cyber security architecture	Define, approve and put in place a cyber security architecture.
3.3.4-2	Monitor architecture compliance	Monitor whether the architecture is being followed.
3.3.4-3-a	Strategic outline of capabilities	Outline the cyber security capabilities and controls needed to meet business requirements.
3.3.4-3-b	Approve the architecture	Get the architecture approved.
3.3.4-3-c	Qualified architects	Require qualified cyber security architects.
3.3.4-3-d	Security-by-design principles	Set design principles for building controls and applying requirements, following security by design.
3.3.4-3-e	Review the architecture	Review the architecture periodically.

3.3.5. Operations: Identity and access management

Ref	Control	What it requires
3.3.5-1	Access management policy	Define, approve and put in place an identity and access management policy with responsibilities and accountabilities.
3.3.5-2	Monitor policy compliance	Monitor compliance with the identity and access policy.
3.3.5-3	Measure access controls	Measure and periodically evaluate the controls inside the access management policy.
3.3.5-4-a	Business need for access	Base access on business requirements, using need-to-have and need-to-know.
3.3.5-4-b	Joiners, movers and leavers	Manage access for all user types, with HR triggering staff changes and an accountable party for third parties. Approve requests formally, act on changes promptly, review rights and keep an audit trail.
3.3.5-4-c	Automate access management	Support user access management with automation.
3.3.5-4-d	Centralise access management	Centralise the identity and access management function.
3.3.5-4-e	MFA for sensitive systems	Use multi-factor authentication for sensitive and critical systems and profiles.
3.3.5-4-f-1	MFA for remote and privileged access	Allocate and restrict privileged and remote access. Require MFA for all remote access, and for privileged access on critical systems, based on a risk assessment.
3.3.5-4-f-2	Review privileged and remote users	Review users with privileged and remote accounts on a regular basis.
3.3.5-4-f-3	Individual accountability	Make every privileged and remote action traceable to one individual.
3.3.5-4-f-4	Shared privileged accounts	For non-personal privileged accounts, limit and monitor their use, keep passwords confidential and change passwords often and at the end of each session.

3.3.6. Operations: Application security

Ref	Control	What it requires
3.3.6-1	Application security standards	Define, approve and put in place cyber security standards for applications.
3.3.6-2	Monitor application compliance	Monitor compliance with the application security standards.
3.3.6-3	Measure application controls	Measure and periodically evaluate how effective the application security controls are.
3.3.6-4	Secure development lifecycle	Develop applications following an approved secure system development life cycle (SDLC) method.
3.3.6-5-a	Secure coding standards	Include secure coding standards in the application security standard.
3.3.6-5-b	Application controls and logging	Specify the controls in place, such as configuration parameters, events to monitor and retain (including access and data) and access management.
3.3.6-5-c	Segregation of duties	Define segregation of duties in the application, backed by a documented authorisation matrix.
3.3.6-5-d	Data protection by classification	Protect data to match its classification, including customer privacy, and avoid unauthorised access and leakage.
3.3.6-5-e	Application vulnerability and patching	Cover vulnerability and patch management for applications.
3.3.6-5-f	Application backup and recovery	Include back-up and recovery procedures.
3.3.6-5-g	Periodic compliance review	Review compliance with the application security standard periodically.

3.3.7. Operations: Change management

Ref	Control	What it requires
3.3.7-1	Change management process	Define, approve and put in place a change management process covering all changes to information assets.
3.3.7-2	Monitor change compliance	Monitor compliance with the change process.
3.3.7-3	Measure change controls	Measure and periodically evaluate the security controls within change management.
3.3.7-4-a	Security rules for changes	Set security requirements for controlling changes, such as impact assessment, classification and review of each change.
3.3.7-4-b	Security testing of changes	Where it applies, require penetration testing and code review of in-house code, review of external code when source is available, or a code review report or independent assurance statement when it is not.
3.3.7-4-c	Business owner approval	Have the business owner approve changes.
3.3.7-4-d	Cyber security function sign-off	Get the cyber security function's approval before a change goes to the Change Advisory Board.
3.3.7-4-e	Change Advisory Board approval	Have the Change Advisory Board approve changes.
3.3.7-4-f	Post-implementation review	Review the related security controls after the change is in place.
3.3.7-4-g	Separate dev, test and live	Keep development, testing and implementation apart, both as environments and in the people involved.
3.3.7-4-h	Emergency changes	Define a procedure for emergency changes and fixes.
3.3.7-4-i	Fall-back and roll-back	Define fall-back and roll-back procedures.

3.3.8. Operations: Infrastructure security

Ref	Control	What it requires
3.3.8-1	Infrastructure security standards	Define, approve and put in place security standards for infrastructure components.
3.3.8-2	Monitor infrastructure compliance	Monitor compliance with the infrastructure standards.
3.3.8-3	Measure infrastructure controls	Measure and periodically evaluate how effective the infrastructure controls are.
3.3.8-4	Cover every site	Apply the standards to infrastructure in the main data centres, the disaster recovery sites and office spaces.
3.3.8-5	Cover every component type	Apply the standards to all types of infrastructure, from operating systems, servers and network devices to databases, workstations, mobile devices and PBX.
3.3.8-6-a	Controls, logging and remote maintenance	Specify controls such as configuration parameters, events to monitor and retain, data-leakage prevention, access management and remote maintenance.
3.3.8-6-b	Segregation of duties	Define segregation of duties for each infrastructure component, backed by a documented authorisation matrix.
3.3.8-6-c	Data protection by classification	Protect data to match its classification, including customer privacy, and avoid unauthorised access and leakage.
3.3.8-6-d	Approved software and secure protocols	Use only approved software and secure protocols.
3.3.8-6-e	Network segmentation	Segment networks.
3.3.8-6-f	Malware and APT protection	Protect against malicious code and viruses, apply application whitelisting and put APT protection in place.
3.3.8-6-g	Infrastructure vulnerability and patching	Cover vulnerability and patch management for infrastructure.
3.3.8-6-h	DDoS protection	Where applicable, use scrubbing services, agree bandwidth, monitor 24x7, test scrubbing at least twice a year and cover both main and disaster recovery sites.
3.3.8-6-i	Infrastructure backup and recovery	Include back-up and recovery procedures.
3.3.8-6-j	Periodic compliance review	Review compliance with the infrastructure security standard periodically.

3.3.9. Operations: Cryptography

Ref	Control	What it requires
3.3.9-1	Cryptographic standard	Define, approve and put in place a cryptographic security standard.
3.3.9-2	Monitor cryptographic compliance	Monitor compliance with the cryptographic standard.
3.3.9-3	Measure cryptographic controls	Measure and periodically evaluate the cryptographic controls.
3.3.9-4-a	Approved solutions and limits	List the approved cryptographic solutions and their technical or legal restrictions.
3.3.9-4-b	When to apply encryption	Say in which circumstances approved cryptographic solutions must be used.
3.3.9-4-c	Key management	Manage encryption keys across their lifecycle, including archiving and recovery.

3.3.10. Operations: Bring your own device (BYOD)

Ref	Control	What it requires
3.3.10-1	BYOD security standard	If staff may use personal devices for work, define, approve and put in place a BYOD standard.
3.3.10-2	Monitor BYOD compliance	Monitor compliance with the BYOD standard.
3.3.10-3	Measure BYOD controls	Measure and periodically evaluate the BYOD controls.
3.3.10-4-a	User responsibilities	Set out what users must do, including awareness training.
3.3.10-4-b	Restrictions and consequences	Tell staff the restrictions and consequences when controls apply to their own devices, for example jailbroken devices, leaving the organisation or losing the device.
3.3.10-4-c	Separate business from personal data	Isolate business information from personal information, for example through containerisation.
3.3.10-4-d	Control mobile applications	Regulate corporate mobile applications and approved public ones.
3.3.10-4-e	MDM, access control and encryption	Use mobile device management with access controls on the device and business container, and encryption for storage and transmission.

3.3.11. Operations: Secure disposal of information assets

Ref	Control	What it requires
3.3.11-1	Secure disposal standard	Define, approve and put in place a standard and procedure for secure disposal.
3.3.11-2	Monitor disposal compliance	Monitor compliance with the disposal standard and procedure.
3.3.11-3	Measure disposal controls	Measure and periodically evaluate the disposal controls.
3.3.11-4	Dispose when no longer needed	Dispose of assets that are no longer needed in line with legal and regulatory duties, including data privacy rules.
3.3.11-5	Make data non-retrievable	Destroy sensitive information so it cannot be recovered, for example by secure erase or wiping, incineration, double cross-cut or shredding.
3.3.11-6	Disposal service providers	Make sure third parties that dispose of, transport or store assets follow the standard, and measure and evaluate their effectiveness regularly.

3.3.12. Operations: Payment systems

Ref	Control	What it requires
3.3.12	Payment systems security standard	Define, approve, implement and monitor a security standard for payment systems, drawing on SAMA's SARIE security policy and the mada security framework and HSM requirements the framework names.

3.3.13. Operations: Electronic banking services

Ref	Control	What it requires
3.3.13-1	E-banking security standard	Define, approve and put in place cyber security standards for electronic banking services.
3.3.13-2	Monitor e-banking compliance	Monitor compliance with the electronic banking standards.
3.3.13-3	Measure e-banking controls	Measure and periodically evaluate the effectiveness of the electronic banking standard.
3.3.13-4-a	Brand protection	Use brand protection measures for online services, including social media.
3.3.13-4-b-1	Official stores and websites	For online and mobile banking, distribute through official application stores and websites.
3.3.13-4-b-2	Detect and take down fakes	For online and mobile banking, detect malicious apps and websites and have them taken down.
3.3.13-4-b-3	Sandboxing	For online and mobile banking, use sandboxing.
3.3.13-4-b-4	Non-caching techniques	For online and mobile banking, use non-caching techniques.
3.3.13-4-b-5	Man-in-the-middle protection	For online and mobile banking, use communication techniques that prevent man-in-the-middle attacks.
3.3.13-4-b-6-a to b	MFA at registration and for all services	Use multi-factor authentication when a customer registers for e-banking, and for every e-banking service offered to customers.
3.3.13-4-b-6-c	Password-protect tokens	Protect hard and soft tokens with a password.
3.3.13-4-b-6-d	Lock out after repeated failures	Revoke customer access after three successive incorrect passwords or invalid PINs.
3.3.13-4-b-6-e	Changing the mobile number	Let customers change their mobile number only at a branch or ATM.
3.3.13-4-b-6-f	Request and activate MFA separately	Handle requesting and activating MFA through different delivery channels.
3.3.13-4-b-6-g	Where MFA is needed	Require MFA for sign-on, adding or changing beneficiaries, adding utility and government payees, high-risk transactions above set limits and password reset.
3.3.13-4-b-7	Beneficiaries via separate channels	For mobile and online banking, add and activate beneficiaries through different delivery channels.
3.3.13-4-b-8	High availability	Keep electronic banking services highly available.
3.3.13-4-b-9	Tell SAMA and customers about downtime	Communicate scheduled downtime to SAMA and customers in good time.
3.3.13-4-b-10	Customer agreements	Have contracts with customers that set out the roles, responsibilities and liabilities of both sides.
3.3.13-4-b-11	SAMA approval for new services	Get SAMA's approval before launching a new electronic banking service.
3.3.13-4-c-1	ATM and POS vulnerabilities	Prevent and detect attacks on ATM and POS applications and infrastructure, such as through cables, USB ports and reboots.
3.3.13-4-c-2	ATM and POS protections	Apply measures such as hardening, malware protection, privacy screens, masking, geo-blocking, CCTV, card revocation after three invalid PINs, anti-skimming and PIN-pad protection.
3.3.13-4-c-3	Remote stop of ATMs	Be able to stop ATMs remotely when malicious activity is seen.
3.3.13-4-d-1	No sensitive data in SMS	Keep sensitive data, such as account balances, out of SMS messages, except for credit cards.
3.3.13-4-d-2	SMS on mobile number change	Send an SMS alert to both the old and the new number when a customer's mobile number changes.
3.3.13-4-d-3	SMS on new MFA request	Send an SMS to the customer's number when a new MFA mechanism is requested.
3.3.13-4-d-4	SMS for transactions	Send an SMS to the customer's number for all retail and personal financial transactions.
3.3.13-4-d-5	SMS for beneficiary changes	Send an SMS to the customer's number when beneficiaries are added, modified and activated.

3.3.14. Operations: Cyber security event management

Ref	Control	What it requires
3.3.14-1	Event management process	Define, approve and put in place a security event management process.
3.3.14-2	Measure event controls	Measure and periodically evaluate the controls within the event management process.
3.3.14-3	Event monitoring standard	Have a monitoring standard that lists, for each information asset, the events that must be monitored, based on its classification or risk profile.
3.3.14-4-a	Security operations centre	Set up a designated team for security monitoring, a security operations centre (SOC).
3.3.14-4-b	Skilled, trained staff	Staff the monitoring with skilled people who are trained continuously.
3.3.14-4-c	Restricted SOC area	Provide a restricted area for SOC activities and workspaces.
3.3.14-4-d	24x7 monitoring resources	Provide the resources for continuous, round-the-clock monitoring.
3.3.14-4-e	Malicious code	Detect and handle malicious code and software.
3.3.14-4-f	Suspicious events and anomalies	Detect and handle security events, suspicious events and anomalies.
3.3.14-4-g	Network packet analysis	Deploy a security network packet analysis solution.
3.3.14-4-h	Protect the logs	Protect logs adequately.
3.3.14-4-i	Compliance monitoring of standards	Monitor compliance with the application and infrastructure standards periodically.
3.3.14-4-j	SIEM correlation	Analyse security logs in a centralised, automated way and correlate events or patterns, using a SIEM.
3.3.14-4-k	Report incidents	Report cyber security incidents.
3.3.14-4-l	Test the SOC independently	Test how well the SOC works through independent periodic testing, such as red-teaming.

3.3.15. Operations: Cyber security incident management

Ref	Control	What it requires
3.3.15-1	Incident management process	Define, approve and put in place an incident management process aligned with the enterprise incident management process.
3.3.15-2	Measure incident controls	Measure and periodically evaluate the controls within the incident process.
3.3.15-3	Events that need a response	Have a standard that lists the mandatory and suspicious events that must be responded to.
3.3.15-4-a	Incident team	Set up a designated incident management team.
3.3.15-4-b	Skilled, trained staff	Staff the team with skilled people who are trained continuously.
3.3.15-4-c	Certified forensic capacity	Have enough certified forensic capacity for major incidents, from internal staff or an external forensic team.
3.3.15-4-d	Restricted CERT area	Provide a restricted area for the computer emergency response team's workspaces.
3.3.15-4-e	Classify incidents	Classify cyber security incidents.
3.3.15-4-f	Handle incidents promptly	Handle incidents in a timely way, and record and monitor progress.
3.3.15-4-g	Protect evidence and logs	Protect relevant evidence and logs.
3.3.15-4-h	Post-incident work	After an incident, do forensics and root-cause analysis.
3.3.15-4-i	Report improvements	Report suggested improvements to the CISO and the committee.
3.3.15-4-j	Incident repository	Keep a repository of cyber security incidents.
3.3.15-5	Tell SAMA immediately	Inform SAMA IT Risk Supervision straight away when a medium or high classified incident has occurred and been identified.
3.3.15-6	SAMA no-objection for media	Get SAMA IT Risk Supervision's no-objection before any media interaction about an incident.
3.3.15-7	Formal incident report to SAMA	After operations resume, send SAMA a formal report: title, class, timings, assets, technical details, root cause, actions, impact, total cost and cost of corrective actions.

3.3.16. Operations: Threat management

Ref	Control	What it requires
3.3.16-1	Threat intelligence process	Define, approve and put in place a threat intelligence management process.
3.3.16-2	Measure threat process	Measure and periodically evaluate the threat intelligence process.
3.3.16-3-a	Internal sources	Draw on internal sources such as access control, application and infrastructure logs, IDS, IPS, SIEM and support functions like legal, audit, helpdesk, fraud and risk.
3.3.16-3-b	External sources	Use reliable, relevant external sources such as SAMA, government agencies, security forums, vendors and specialist notification services.
3.3.16-3-c	Analysis method	Define a method for analysing threat information periodically.
3.3.16-3-d	Threat details to capture	Record details of threats found, such as methods, actors, motivation and type.
3.3.16-3-e	Relevance and follow-up	Judge whether the intelligence is relevant and actionable, for example by the SOC or risk management.
3.3.16-3-f	Share intelligence	Share relevant intelligence with stakeholders such as SAMA and BCIS members.

3.3.17. Operations: Vulnerability management

Ref	Control	What it requires
3.3.17-1	Vulnerability management process	Define, approve and put in place a process to find and fix application and infrastructure vulnerabilities.
3.3.17-2	Measure vulnerability process	Measure and periodically evaluate how effective the process is.
3.3.17-3-a	Cover all assets	Include all information assets in the process.
3.3.17-3-b	Risk-based scan frequency	Set how often vulnerability scans run, based on risk.
3.3.17-3-c	Classify vulnerabilities	Classify vulnerabilities.
3.3.17-3-d	Timelines to fix	Set deadlines for mitigation for each class.
3.3.17-3-e	Prioritise by asset class	Prioritise by the classification of the affected information assets.
3.3.17-3-f	Patch management	Define how patches are managed and deployed.

3.4.1. Third party: Contract and vendor management

Ref	Control	What it requires
3.4.1-1	Security requirements in contracts	Define, approve, put in place and communicate cyber security requirements within contract and vendor management.
3.4.1-2	Monitor vendor compliance	Monitor compliance with the contract and vendor management process.
3.4.1-3	Measure vendor controls	Measure and periodically evaluate the security controls inside the process.
3.4.1-4-a	When security must be involved	Decide when the cyber security function must be actively involved, for example in due diligence.
3.4.1-4-b	Baseline security requirements	Set the baseline requirements that apply to every third party.
3.4.1-4-c	Right to review and audit	Secure the right to carry out security reviews and audits periodically.
3.4.1-5-a	Risk assessment in procurement	Run a cyber security risk assessment as part of procurement.
3.4.1-5-b	Requirements in the tender	Set the specific security requirements in the tender.
3.4.1-5-c	Evaluate vendor replies	Evaluate prospective vendors' replies against those requirements.
3.4.1-5-d	Test agreed requirements	Test the agreed security requirements, based on risk.
3.4.1-5-e	Incident escalation	Define how incidents are communicated and escalated.
3.4.1-5-f	Exit, termination and renewal	Set security requirements for exiting, ending or renewing a contract, including escrow agreements where relevant.
3.4.1-5-g	Mutual confidentiality	Agree a mutual confidentiality agreement.
3.4.1-6	Report on SLAs	Report on, review and evaluate the security requirements in service level agreements on a regular basis.

3.4.2. Third party: Outsourcing

Ref	Control	What it requires
3.4.2-1	Security in the outsourcing policy	Define, approve, put in place and communicate cyber security requirements within the outsourcing policy and process.
3.4.2-2	Measure outsourcing controls	Measure and periodically evaluate those requirements.
3.4.2-3-a	SAMA approval before material outsourcing	Get SAMA's approval before any material outsourcing.
3.4.2-3-b	Cyber security function involved	Involve the cyber security function in outsourcing.
3.4.2-3-c	Follow the SAMA outsourcing circular	Comply with SAMA's circular on outsourcing.

3.4.3. Third party: Cloud computing

Ref	Control	What it requires
3.4.3-1	Cloud computing policy	For hybrid and public cloud, define, approve, put in place and communicate security controls inside a cloud policy. Private (internal) cloud is out of scope.
3.4.3-2	Monitor cloud policy compliance	Monitor compliance with the cloud computing policy.
3.4.3-3	Measure cloud controls	Measure and periodically evaluate the cloud security controls.
3.4.3-4-a-1	Cloud risk assessment and due diligence	Assess security risk and carry out due diligence on the cloud provider and its services.
3.4.3-4-a-2	SAMA approval for cloud	Get SAMA's approval before using cloud services or signing the contract.
3.4.3-4-a-3	Contract before use	Have a contract, including the security requirements, in place before using cloud services.
3.4.3-4-b-1	Data location	As a rule use cloud services in Saudi Arabia, and get SAMA's explicit approval to use services outside the country.
3.4.3-4-c-1	No secondary use of data	The provider must not use your data for secondary purposes.
3.4.3-4-d-1	Provider security controls	The provider must run and monitor the security controls set by the risk assessment to protect confidentiality, integrity and availability.
3.4.3-4-e-1	Data segregation	Your data must be logically segregated and always identifiable by the provider as separate from other customers' data.
3.4.3-4-f-1	Business continuity	Meet business continuity requirements in line with your business continuity policy.
3.4.3-4-g-1 to 3	Rights to review, audit and examine	Hold the right to run a cyber security review, audit and examination at the cloud provider.
3.4.3-4-h-1 to 3	Exit terms	Hold termination rights, and have the provider return your data on termination and then irreversibly delete it.

Download SAMA CSF controls list (Excel)Free account needed. You come straight back to the file.

SecureXcel unified controls workbook

Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.

A summary, not the source. The references and short headings identify each item. The wording beside them is our own summary and is not a quotation, a legal opinion or advice. Check the published source for the exact requirement. We help organisations with this: see our Cybersecurity Assessment service.

Questions people ask

How are SAMA CSF controls numbered?

A control is a subdomain number followed by a dash and the numbered consideration, such as 3.3.5-4-f-1. We list a lettered or numbered part separately when it holds a distinct duty, and mark parts covered together with a range such as -c to d.

Do all subdomains apply to every institution?

No. All subdomains apply to banks. For other institutions, 3.1.2 (sector strategy alignment) applies where relevant, and 3.2.3, 3.3.12 and 3.3.13 are excluded, though PCI or SWIFT standards apply if you handle cardholder data or SWIFT, and online services need MFA.

What maturity level does SAMA expect?

The framework says organisations should operate at maturity level 3 or higher on its six-level scale: controls defined, approved, implemented, and monitored for compliance with KPIs.

Does it require reporting incidents to SAMA?

Yes. Control 3.3.15-5 asks you to tell SAMA IT Risk Supervision immediately about a medium or high classified incident, and 3.3.15-7 asks for a formal report after operations resume.

Is this a complete statement of the framework?

No. It is a plain-English summary in our own words, following SAMA's numbering. The framework and any SAMA circulars are the authority, so read the source text before relying on a requirement.