SAMA Cyber Resilience Fundamental Requirements (CRFR) Compliance

SAMA CRFR compliance means meeting the Cyber Resilience Fundamental Requirements set by the Saudi Central Bank (SAMA), the regulator responsible for the stability and security of the Kingdom's financial sector. Published in January 2022, the CRFR is a risk-based, prioritized set of mandatory controls organized across three domains, intended to ensure that entities entering the financial sector are genuinely resilient before they go live.

The framework applies to entities intending to qualify for SAMA's Regulatory Sandbox environment and to entities seeking a license to operate in the Kingdom of Saudi Arabia. It acts as a catalyst that enables these entities to meet SAMA's minimum cyber resilience licensing requirements. SAMA owns the framework and is responsible for periodically updating it.

The CRFR was published in January 2022 and was developed and is owned by the Saudi Central Bank (SAMA), which is responsible for periodically updating it. Entities adopt and implement the framework, while SAMA interprets and reviews it.

The CRFR is not a replacement for SAMA's Cyber Security Framework (CSF) or Business Continuity Management Framework (BCMF). It is a foundational, licensing-stage requirement that maps directly to those larger frameworks. Once an entity is licensed, it is expected to comply with the full set of relevant SAMA regulatory requirements.

Implementation of the CRFR is subject to periodic self-assessment based on a questionnaire, a copy of which is sent to SAMA. SAMA reserves the right to review that self-assessment to confirm compliance at its discretion, and it can also audit an entity's compliance at any time. An entity that cannot demonstrate compliance risks having its sandbox graduation or license request prohibited.

A control is "present" when an entity can point to a written policy or an installed tool. It is "effective" only when, put under real attack, it does what it was meant to, blocking, detecting, logging, and raising an alert. The CRFR's expectation sits on the second of these: a fundamental control that lives only on paper does not meet the framework, which asks for controls that are implemented, kept under watch, and demonstrably working whenever SAMA looks.

Validation puts an entity's live controls under emulated adversary activity safely and records what each one actually stops, catches, logs, and alerts on. That converts a posture built on assumptions into one built on observed results: a continuously refreshed, time-stamped record mapped to MITRE ATT&CK that an entity can feed straight into its self-assessment and place in front of a SAMA reviewer or auditor whenever asked, not only on assessment day.

Picus runs real attack techniques against an entity's defenses and turns the outcome into the dated, measurable evidence the CRFR's risk-based approach calls for. Across the controls in scope, from governance and risk assessment through identity and access, network, endpoint, and detection, to incident notification, it shows where defenses hold and where they fail, then returns vendor-specific and vendor-neutral fixes for the gaps. A continuously updated threat library keeps that testing current, so an entity stays audit-ready as new attacks emerge.