SAMA Cyber Security Framework (CSF) Compliance

SAMA CSF compliance means meeting the requirements of the Cyber Security Framework set by the Saudi Arabian Monetary Authority (SAMA), the regulator responsible for the stability and security of the Kingdom's financial sector. The framework is principle-based and ties compliance to a six-level cyber security maturity model, with Member Organizations expected to reach maturity level 3 or higher.

The framework applies to all Member Organizations regulated by SAMA, including all banks operating in Saudi Arabia, all insurance and reinsurance companies, all financing companies, all credit bureaus, and the Financial Market Infrastructure. Member Organizations adopt and implement the framework, while SAMA owns, interprets, and periodically reviews it.

SAMA CSF defines six maturity levels (0 through 5), and Member Organizations are expected to operate at level 3 ("Structured and formalized") or higher. Level 3 requires that controls be defined, approved, implemented, and demonstrable. Level 4 requires effectiveness to be measured and periodically evaluated with KRIs and KPIs, and level 5 requires continuous improvement supported by automated real-time monitoring.

SAMA expects defensible, repeatable, and current evidence that controls work as intended. The maturity model ties progression to demonstrable effectiveness: implementation must be capable of being demonstrated at level 3, and effectiveness must be measured and periodically evaluated at level 4. That evidence must be available for a self-assessment, a SAMA review, or a SAMA audit at any time.

Control presence means a policy is written or a tool is deployed. Control effectiveness means the control actually blocks, detects, logs, and alerts on real attacks. SAMA's higher maturity levels explicitly demand effectiveness, not just presence, which is why documenting a policy or deploying a tool alone does not move an entity up the maturity model.

Security validation runs adversary-emulated attacks against live controls to see whether they actually block and detect real threats. It turns periodic, assumption-based compliance into continuous, evidence-based assurance, producing scored, time-stamped reports mapped to MITRE ATT&CK that satisfy SAMA IT Risk Supervision, internal auditors, and the board, not just at assessment time but continuously, while helping entities progress and sustain higher maturity levels.

The Picus Platform validates control effectiveness against real-world attack techniques and produces the measurable, time-stamped evidence the framework requires at every maturity level. It maps attack paths, simulates real threats, validates control effectiveness across governance, risk management, identity and access, infrastructure, detection and response, threat management, and vulnerability management, and returns vendor-specific and vendor-neutral mitigation guidance, with new threats added on an ongoing basis to keep effectiveness testing sustainable and audit-ready.