SAMA CSF Compliance Guide 2026: Maturity Levels, Domains, and What Regulators Expect

The Cyber Security Framework was issued by the Saudi Central Bank to help regulated financial institutions, referred to as Member Organizations, identify and manage cyber risk in a structured, measurable way. It draws on established standards such as NIST, ISO 27001, PCI DSS, and Basel principles, but it is not a copy of any one of them.

Two things matter more than most guides admit. First, it is principle-based, not a checklist. The CSF lays out objectives and control considerations that institutions should consider, not a rigid list of boxes to tick. Where a control genuinely cannot be implemented as written, there is a formal path to propose compensating controls or request a waiver directly from SAMA.

Second, there is no SAMA CSF certificate. Compliance is established through periodic self-assessment against SAMA's own questionnaire, which SAMA then reviews and audits. Anyone offering to sell you a CSF certification is describing something that does not exist in the framework.

The CSF applies to SAMA-regulated entities, which today spans banks, finance companies, payment systems and payment service providers, digital banks, money changers, credit bureaus, and firms operating in SAMA's regulatory sandbox. Note that insurance supervision moved to the Insurance Authority in late 2023, so insurers should confirm their current governing cyber instrument with that regulator rather than assuming the CSF still applies to them directly.

Not every domain applies identically to every entity type. Banks carry the full weight of the framework, while some subdomains, such as those tied specifically to payment systems or electronic banking services, are excluded for institutions that do not offer those services. Carve-outs often come with their own conditions attached, for example mandatory multi-factor authentication if you offer any online customer services.

The CSF organizes its requirements into four main domains, broken down into 32 subdomains, each with its own principle, objective, and set of control considerations.

1. Cyber Security Leadership and Governance covers board and executive accountability: governance structures, cybersecurity strategy, policy, defined roles and responsibilities, security in project management, and organization-wide awareness and training. This is where SAMA checks whether the board is genuinely accountable, not merely briefed.

2. Cyber Security Risk Management and Compliance covers how risk is identified, assessed, and tracked over time, alignment with regulatory and industry standards, and, critically, the periodic reviews and independent audits that feed your maturity evidence. Annual reviews and penetration tests for customer- and internet-facing services fall under this domain.

3. Cyber Security Operations and Technology is by far the largest domain, spanning 17 subdomains including identity and access management, application security, infrastructure security, cryptography, change management, BYOD, secure disposal, payment systems, electronic banking, and, importantly, event management, incident management, threat management, and vulnerability management. The sheer size of this domain reflects where SAMA's operational scrutiny is heaviest.

4. Third-Party Cyber Security covers contract and vendor management, outsourcing, and cloud computing. Cloud sits inside this domain as a single subdomain, not as a separate SAMA instrument, a distinction worth getting right since a lot of secondhand guidance treats cloud governance as its own standalone rulebook.

This is where most institutions either get ahead of the curve or fall behind it. The CSF maturity model runs from Level 0 to Level 5, six levels in total, and each control is scored individually against this scale. To reach a given level, an institution must first satisfy every requirement of the levels below it.

Level 0, Non-existent: no documentation, no awareness, control not in place. Level 1, Ad-hoc: controls exist informally and inconsistently across teams. Level 2, Repeatable but informal: standardized practice exists but is not formally approved. Level 3, Structured and formalized: controls are documented, approved, implemented, and demonstrable, with KPIs tracked. Level 4, Managed and measurable: control effectiveness is periodically measured using defined KRIs and thresholds. Level 5, Adaptive: continuous improvement, integrated with enterprise risk management and benchmarked against peer data.

Every Member Organization is expected to operate at Level 3 or above as a minimum. That is the regulatory floor, and it is a meaningful one. Level 3 requires more than a policy on file: it means the control is implemented in a structured way, its operation can be demonstrated with evidence, and its performance is tracked through defined KPIs.

Banks carry an additional obligation: four specific subdomains, event management, incident management, threat management, and vulnerability management, must be maintained at Level 4, not just Level 3. The difference between the two levels is the difference between having a control and proving it works. Level 3 is about existence and demonstrability, while Level 4 requires ongoing measurement of effectiveness against defined key risk indicators. A control can be flawlessly implemented and still stall at Level 3 indefinitely if nobody is measuring whether it is actually reducing risk.

If your GRC tool has every subdomain targeted uniformly at Level 3, that is worth checking. For a bank, the four subdomains above should be configured at Level 4.

A few things consistently separate institutions that sail through SAMA reviews from those that do not.

Evidence over assertion. SAMA's self-assessment process is reviewed and audited by the regulator itself. A control marked implemented needs supporting evidence: policies, procedures, screenshots, interview records, KPI dashboards, not just a checkbox.

Board-level ownership, not IT-level ownership. Governance failures are a recurring theme in gap assessments. The board needs to receive regular, substantive cybersecurity reporting and be able to demonstrate accountability, not just awareness.

Third-party and cloud due diligence. Before signing any contract for hybrid or public cloud services, institutions are expected to obtain SAMA's approval, complete a risk assessment and due diligence on the provider, and secure contractual audit rights. Data is expected to stay in-Kingdom in principle: using cloud services hosted outside Saudi Arabia is permitted, but only with explicit SAMA approval, not by default.

Prompt incident notification. Medium- and high-classified security incidents must be reported to SAMA immediately. There is no fixed hour-count in the framework, so immediately should be read as exactly that. Institutions also need SAMA's no objection before engaging with media about an incident, a step that is often missing from incident response runbooks.

A genuine gap assessment, not a vendor spreadsheet. SAMA circulars call for an in-depth, accurate assessment of current cybersecurity status as the starting point for any compliance roadmap: scoping which subdomains apply, assessing each control against the maturity model, and collecting evidence before committing to a board-approved remediation timeline.

If you are building or refreshing a SAMA CSF program, a workable first sequence looks like this.

1. Confirm your institution's exact scope of applicability, since subdomains and carve-outs differ by entity type. 2. Run a proper gap assessment against SAMA's actual questionnaire and maturity model, not a generic vendor framework. 3. Set differentiated maturity targets: Level 3 across the board, Level 4 for the four bank-specific subdomains if applicable. 4. Review every cloud and outsourcing arrangement for pre-approval, data location, and audit-rights gaps. 5. Build the evidence trail, KPIs at Level 3 and KRIs with effectiveness measurement at Level 4, so your self-assessment can withstand SAMA's own review. 6. Get board sign-off on the roadmap and keep the reporting cadence visible and documented.

Waaqi (واقي) ships with a pre-built SAMA CSF control library covering all 4 domains and 32 subdomains, with maturity targets configured correctly out of the box: Level 3 as the baseline and Level 4 pre-set for the event, incident, threat, and vulnerability management subdomains banks must evidence at the higher level.

Gap assessments run against SAMA's actual questionnaire structure, not a generic template. Evidence is collected once per control and linked to the maturity level it supports, so your self-assessment is backed by a demonstrable trail rather than assertions. KPIs and KRIs are tracked continuously, which is exactly what separates a Level 3 control from a Level 4 one.

Third-party and cloud arrangements are managed in the same platform: vendor due diligence, contract audit rights, outsourcing registers, and data-location tracking aligned to SAMA's in-Kingdom expectations. Incident workflows include immediate notification steps and the media no-objection checkpoint, so nothing is missed under pressure.

Executive dashboards give your board the substantive, regular cybersecurity reporting SAMA expects, with maturity posture by domain, remediation progress, and trend lines, all audit-ready. Waaqi is hosted in the region with data residency options that fit Saudi regulatory expectations.

The SAMA CSF rewards institutions that treat it as an ongoing security discipline rather than an annual paperwork exercise. Reaching Level 3 gets you compliant; building toward Level 4 and 5 on the controls that matter most is what actually keeps you resilient, and what regulators notice when they look closely.

Want to see your SAMA CSF maturity posture mapped, evidenced, and board-ready in weeks instead of months? Book a demo of Waaqi at www.waaqi.ai and run your next self-assessment with confidence.

This guide is for informational purposes and reflects publicly available regulatory guidance as of 2026. It is not legal advice. Institutions should verify current requirements directly with SAMA or a qualified compliance advisor.