Regulatory Standards · Saudi Arabia
SAMA Cyber Security Framework
SAMA CSF maturity, evidenced control by control.
The Saudi Central Bank's framework sets cyber security expectations and a minimum maturity level for regulated entities. Astragar maps each domain to controls and evidence, alongside PDPL.
Register interest in SAMA CSFComing to Astragar GRC
4
Domains: governance, risk & compliance, operations & technology, third parties
Level 3
Minimum maturity expected of regulated entities
SAMA
Applies to Saudi banks, insurers and finance companies
What SAMA CSF requires
The obligations, in brief.
Leadership & governance
Cyber security strategy, committee and policies.
Risk & compliance
Risk management and compliance with regulatory requirements.
Operations & technology
Asset, identity, vulnerability and incident management.
Third parties
Cyber security in outsourcing and cloud arrangements.
How Astragar helps
From checklist to measurable risk.
01
Requirement → control mapping
Map every SAMA CSF requirement to controls, systems, assets and owners.
02
Evidence, continuously
Collect and maintain evidence, with sign-off from contributor to IT auditor, CISO and executive office.
03
Exposure behind the gaps
See which vulnerabilities and sensitive data put SAMA CSF controls at risk.
04
Risk in financial terms
Prioritise remediation by business and financial impact, not checklist order.
Pair SAMA CSF with PDPL: one evidence layer, including Arabic and English data discovery.
Sign-off workflow
Evidence Contributor
→IT Auditor
→CISO
→Executive Office
Find the data. Test the controls. Reduce the risk.
SAMA CSF mapping is coming to Astragar GRC. Talk to us about early access and how your existing evidence already applies.
Talk to usAstragar supports compliance programmes with technical evidence and risk analysis. It does not provide legal advice or issue certifications.
See your cyber risk in $ terms, not CVSS scores.
