Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Financial services › SAMA Cyber Security Framework (CSF)

SAMA Cyber Security Framework (CSF)

Type	Instrument
Issuing authority	Saudi Central Bank (SAMA)
Framework	Financial services
Tier	Rules, controls & standards
Legal status	In force
Instrument number	Saudi Central Bank (SAMA)
Version	1.0
Dates	Version 1.0, May 2017; binding SAMA supervisory requirement
Last verified	2026-10-20

The Saudi Central Bank (SAMA) Cyber Security Framework (CSF), version 1.0 of May 2017, is a binding SAMA supervisory requirement for its Member Organisations. The issuing circular is reported as No. 381000091275 (28/8/1438H, 24 May 2017).

• Maturity: Member Organisations must operate at maturity level 3 or higher (s2.4). A later SAMA circular reportedly requires banks to reach level 4 on specific subdomains; this is not confirmed.
• Domains: leadership and governance; risk management and compliance; operations and technology; third-party cyber security.
• Cloud (3.4.3): SAMA approval before any cloud use; in principle Saudi-located; offshore only with explicit approval.
• Incidents (3.3.15): inform SAMA immediately of medium or high incidents; no hours are set.
• Insurers: the CSF names insurers as Member Organisations, but the Insurance Authority now supervises them. Whether the CSF still binds insurers is to be confirmed.
• Licence applicants first meet the Cyber Resilience Fundamental Requirements (CRFR).

Sector rules and the PDPL. Credit data and health data are sensitive data under the PDPL, so the registration trigger in draft Art 34 of the October 2026 amendments to the PDPL Implementing Regulation (IR) would capture most SAMA licensees. A PDPL-compliant transfer does not replace SAMA approval or no objection for offshore cloud or outsourcing. PDPL Arts 30(1) and 42 preserve SAMA's powers. Read with the PDPL, the IR, the Transfer Regulation and the October 2026 draft (comments close 5 November 2026).

Documents

• Hosted official text (PDF, English)

In this framework

• The Capital Market Law
• Saudi Central Bank Law
• Law of Payments and Payment Services and its Implementing Regulation
• Credit Information Law
• Banking Control Law
• Implementing Regulations of the Credit Information Law
• Payment Services Provider Regulations (2020)
• Capital Market Institutions Regulations
• SAMA Rules on Outsourcing (No. 41027017)
• Financial Consumer Protection Principles and Rules
• Cyber Resilience Fundamental Requirements (CRFR)
• Adherence to the PDPL and Data Governance Policies, Regulations and Rules (SAMA No. 43045328)
• Business Continuity Management Framework
• Counter-Fraud Framework (banks)
• Counter-Fraud Fundamental Requirements (finance and payment companies)
• Enhancement of Operational Resilience to Address Quantum Computing Risks
• Oversight Framework for Payment Systems and Their Operators
• Open Banking Framework
• IT Governance Framework
• Cyber Threat Intelligence Principles
• Ethical Red Teaming Framework
• CMA Cybersecurity Guidelines for Capital Market Institutions
• Payment Services Provider Regulatory Guidelines

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21