GoAgile Technologies
English Arabic

Compliance & AssuranceSAMA CSF

SAMA Cyber Security Framework compliance: reach and prove your target maturity level

We assess your programme against the SAMA Cyber Security Framework, raise maturity where it is low, run red team exercises under FEER and prepare the self-assessment and evidence that SAMA reviews.

  • Maturity assessment and remediation roadmap
  • Policies, controls and evidence mapped to the framework
  • Red teaming and board reporting
Assess my SAMA maturity All cyber security services
Domains
4Domains
Maturity scale
0 to 5Maturity scale
Red teaming
FEERRed teaming
Baseline
Level 3Baseline

01Overview

What is the SAMA Cyber Security Framework?

The SAMA Cyber Security Framework (CSF) sets the cyber security governance, risk, operations and third-party requirements for banks, insurers, finance and payment companies regulated by the Saudi Central Bank. Organisations assess their maturity from level 0 to 5, report it to SAMA and are expected to reach at least level 3 across the framework.

The framework is organised into four domains: cyber security leadership and governance, cyber security risk management and compliance, cyber security operations and technology, and third-party cyber security. Each contains subdomains with defined control objectives.

Maturity is assessed periodically by self-assessment against a questionnaire from SAMA, then reviewed and audited. Higher maturity in areas such as security operations is expected over time.

Applies to
Banks, insurers, finance and payment companies regulated by SAMA
Domains
Governance, risk and compliance, operations and technology, third party
Maturity
Level 0 to 5, level 3 as a baseline
Related
FEER red teaming, business continuity framework
Assessment
Self-assessment, with SAMA review and audit

02What we do

Six services for SAMA-regulated entities

From first assessment to board reporting.

  1. 01

    Maturity assessment

    Independent assessment of each subdomain against the SAMA maturity scale.

    • Questionnaire and evidence review
    • Technical validation
    • Maturity score by subdomain
    • Target level and gap register

    You receive

    A defensible maturity score and a gap list.

  2. 02

    Policy and framework build

    Governance, risk and control documentation aligned to the framework.

    • Cyber security strategy and policies
    • Risk management framework
    • Standards and procedures
    • Metrics and reporting

    You receive

    A documented control framework.

  3. 03

    Technical remediation

    Implementation of controls in identity, network, data, logging and endpoints.

    • Access and privileged access
    • Security monitoring
    • Vulnerability management
    • Data protection

    You receive

    Controls operating in practice.

  4. 04

    Third-party cyber risk

    Programme for assessing and monitoring vendors.

    • Vendor tiering
    • Security assessment questionnaires
    • Contract clauses
    • Continuous monitoring

    You receive

    Supplier risk under control.

  5. 05

    Red teaming (FEER)

    Threat-led red team exercises aligned to SAMA's framework.

    • Scenario design
    • Controlled production testing
    • Purple team workshop
    • Report for leadership

    You receive

    Evidence of real-world resilience.

  6. 06

    Board and SAMA reporting

    Dashboards and reports for leadership and the regulator.

    • Maturity trend
    • Key risk indicators
    • Remediation tracking
    • SAMA submission support

    You receive

    Reports that the board and SAMA understand.

03How we work

From baseline to target maturity

A practical path with checkpoints.

  1. Step 1 · Weeks 1 to 6

    Baseline

    Assess maturity by subdomain.

  2. Step 2 · Week 7

    Target

    Agree target levels and priorities.

  3. Step 3 · Weeks 7 to 14

    Document

    Policies and framework.

  4. Step 4 · Months 4 to 12

    Implement

    Technical and process controls.

  5. Step 5 · Months 9 to 12

    Test

    Penetration test and red team.

  6. Step 6 · Ongoing

    Report

    Re-assess and report.

04Reference

SAMA maturity levels

What each level means in practice.

LevelNameWhat it looks like
0Non-existentNo documented approach
1Ad hocDone inconsistently, by individuals
2Repeatable but informalDone the same way, not documented or measured
3Structured and formalisedDocumented, approved and followed. Baseline expectation.
4Managed and measurableMeasured, reported and controlled
5AdaptiveContinuously improved using metrics and intelligence

Level wording summarised from SAMA's framework. Check the current text of the framework for exact definitions.

05Related SAMA documents

The SAMA documents we work to

The framework sits among related requirements.

CSF

Cyber Security Framework

The core framework and maturity model.

How we help: Assessment and remediation.

FEER

Ethical Red Teaming Framework (2019)

Governs threat-intelligence-led red teaming of financial entities.

How we help: Red team services.

BCM

Business Continuity Management framework

Requirements for continuity and resilience.

How we help: Continuity and recovery testing.

Outsourcing

Third-party and outsourcing requirements

Controls for supplier relationships.

How we help: Vendor risk programme.

06Saudi Arabia and the GCC

What SAMA-regulated entities should expect

The regulator is engaged and the bar rises.

  • SAMA

    Periodic self-assessment

    SAMA issues a questionnaire and reviews results, so accuracy matters. We make the scoring defensible.

  • Operations

    Security operations expectations

    Subdomains such as security operations are expected to reach higher maturity than the baseline.

  • Efficiency

    Overlap with NCA and PCI DSS

    Many controls satisfy several frameworks. We map them to avoid duplicate work.

07Why GoAgile

Why banks and insurers choose GoAgile

We have worked with financial institutions in the Kingdom.

Talk to a security specialist

  • Financial sector context

    We understand banking systems and payments, including ERP and payment integrations.

  • Defensible scoring

    Evidence-based maturity assessments.

  • Red team capability

    FEER-aligned exercises.

  • Technical depth

    We implement the controls.

  • Arabic and English

    Both for regulators and boards.

Credentials

ISO 9001 certified
ISO 9001
Quality management
ISO 14001 certified
ISO 14001
Environmental management
ISO 45001 certified
ISO 45001
Occupational health and safety
ISO 27001 certified
ISO 27001
Information security management
Registered cybersecurity service provider
MSOC licence, Tier 2
Penetration testing accreditation
Qualified Security Assessor company
Type II report, GoAgile
Business continuity management

08Clients

Trusted by banks, operators and public bodies across Saudi Arabia and the GCC

Organisations in regulated sectors choose GoAgile because security is delivered by the team that also builds and runs their infrastructure.

  • Tier-1 Saudi bank

    Banking

  • National energy operator

    Oil, gas and power

  • Government authority

    Public sector

  • Regional telecom operator

    Telecommunications

  • Healthcare group

    Hospitals and clinics

  • Retail and e-commerce group

    Retail

  • Ports and logistics operator

    Logistics

  • Insurance company

    Insurance

  • Fintech and payments provider

    Financial technology

  • Industrial manufacturer

    Manufacturing

Tier-1 Saudi bankRed team exercise

A threat-led red team exercise for a bank

The bank needed evidence that its people, processes and detection would hold up against a realistic attacker, in line with SAMA expectations.

  • Agreed rules of engagement and a threat scenario with the CISO
  • Ran a controlled exercise against production systems
  • Ran a purple team workshop so defenders could see every step

Result: Detection gaps were fixed, playbooks were updated and the board received a plain-language report.

Government authorityNCA ECC programme

NCA ECC gap assessment and remediation roadmap

The authority had to demonstrate compliance with the NCA Essential Cybersecurity Controls and did not know where to start.

  • Control-by-control gap assessment
  • Policy and procedure set aligned to ECC
  • A phased remediation roadmap with owners and dates

Result: A clear compliance position, a funded roadmap and audit-ready evidence.

Healthcare groupPDPL programme

A PDPL compliance programme for a healthcare group

Patient data sat in many systems, with no single record of what was held, why, or who could see it.

  • Personal-data inventory and flow mapping
  • Lawful-basis, consent and retention records
  • A data-subject request process and breach procedure

Result: A defensible PDPL position and a process the privacy team could run day to day.

Client names are withheld for confidentiality.

09Related services

Explore more from this practice

Each service stands alone and works better with the others.

Is your next SAMA self-assessment approaching?

Tell us your entity type and current maturity. We will propose an assessment and a roadmap.

Assess my SAMA maturity

10Questions answered

SAMA Cyber Security Framework FAQs

Who must comply with the SAMA Cyber Security Framework?

Banks, insurers, finance companies, payment providers and other entities regulated by SAMA. Check with SAMA for your category.

What maturity level does SAMA expect?

Organisations should operate at least at maturity level 3, with higher levels expected in some areas such as security operations.

What is FEER?

The Financial Entities Ethical Red Teaming Framework, adopted by SAMA in May 2019, which governs threat-intelligence-led red team exercises in the financial sector.

How often is the self-assessment?

Periodically, using a questionnaire provided by SAMA. Timing is set by SAMA and may change.

Can you act as an independent assessor?

We can provide independent assessment and advisory support. Confirm any requirement for specific assessor status with SAMA.

How does SAMA CSF relate to NCA ECC?

They overlap, and many controls satisfy both. We map them together so you do not duplicate work.

How long does it take to move up a maturity level?

Moving from level 2 to 3 across many subdomains often takes twelve months or more, depending on resources.

Talk to a SAMA compliance specialist

Tell us about your environment and what you need. We will respond with a scoped proposal, not a brochure.

Why GoAgile for SAMA Cyber Security Framework?

Specialists who do this work every week, reporting in Arabic and English.

  • Aligned to NCA, SAMA and the PDPL
  • Arabic and English reporting
  • Certified practices, ISO 27001
  • Confidential by default

+966 53 534 5103
contact@goagiletechnologies.com

By providing your contact information and clicking ‘submit’, you authorize GoAgile Technologies to store your contact details and reach out regarding your enquiry.