SAMA CSF Domains and Maturity Levels (0

The Saudi Central Bank Cyber Security Framework (SAMA CSF) v1.0 — as published in the official Rulebook — structures expectations across 4 domains and 32 subdomains. Each subdomain states a principle, objective, and control considerations. Member Organizations should operate at maturity Level 3 or higher on the 0–5 scale.

Structure: CLG 7 + CRMC 5 + COT 17 + TPC 3 = 32 subdomains. Maturity levels 0–5; target Level 3+. Per subdomain, SAMA states control considerations rather than a single invented “total controls” headline.

Maturity Levels 0–5

0–2 — Incomplete through developing practices
3 — Defined — Expected minimum operating level for Member Organizations
4–5 — Managed through optimising continuous improvement

3.1 Cyber Security Leadership and Governance (7)

3.1.1 — Cyber Security Governance
3.1.2 — Cyber Security Strategy
3.1.3 — Cyber Security Policy
3.1.4 — Cyber Security Roles and Responsibilities
3.1.5 — Cyber Security in Project Management
3.1.6 — Cyber Security Awareness
3.1.7 — Cyber Security Training

3.2 Cyber Security Risk Management and Compliance (5)

3.2.1 — Cyber Security Risk Management
3.2.2 — Regulatory Compliance
3.2.3 — Compliance with (inter)national industry standards
3.2.4 — Cyber Security Review
3.2.5 — Cyber Security Audits

3.3 Cyber Security Operations and Technology (17)

3.3.1 — Human Resources
3.3.2 — Physical Security
3.3.3 — Asset Management
3.3.4 — Cyber Security Architecture
3.3.5 — Identity and Access Management
3.3.6 — Application Security
3.3.7 — Change Management
3.3.8 — Infrastructure Security
3.3.9 — Cryptography
3.3.10 — Bring Your Own Device (BYOD)
3.3.11 — Secure Disposal of Information Assets
3.3.12 — Payment Systems
3.3.13 — Electronic Banking Services
3.3.14 — Cyber Security Event Management
3.3.15 — Cyber Security Incident Management
3.3.16 — Threat Management
3.3.17 — Vulnerability Management

3.4 Third Party Cyber Security (3)

3.4.1 — Contract and Vendor Management
3.4.2 — Outsourcing
3.4.3 — Cloud Computing

How CyberSilo Helps

CSA organises SAMA subdomain evidence and maturity tracking for financial institutions
ThreatHawk supports event and incident management evidence under 3.3.14 / 3.3.15
Dual mapping with NCA ECC for banks and insurers

Raise Subdomain Maturity to Level 3+

Walk 32 subdomains with owners, control considerations, and SIEM proof where operations demand it.

Talk to CyberSilo SAMA hub

CSF services · Automation guide · SIEM for SAMA

Frequently Asked Questions

How is SAMA CSF structured?

Four domains and 32 subdomains: Cyber Security Leadership and Governance (7), Cyber Security Risk Management and Compliance (5), Cyber Security Operations and Technology (17), and Third Party Cyber Security (3).

What maturity level is required?

Member Organizations should operate at maturity Level 3 or higher on the 0–5 scale.

Where is the official TOC?

SAMA Rulebook Cyber Security Framework v1.0 — subdomain sections 3.1.1 through 3.4.3.

SAMA CSF Domains and Maturity Levels (0–5) Explained

Maturity Levels 0–5

3.1 Cyber Security Leadership and Governance (7)

3.2 Cyber Security Risk Management and Compliance (5)

3.3 Cyber Security Operations and Technology (17)

3.4 Third Party Cyber Security (3)