SAMA Cyber Security Framework Audit
End-to-end SAMA CSF audit — control assessment, maturity scoring, submission pack.
Full SAMA Cyber Security Framework audit for Saudi banks, insurers, finance companies and payment service providers under the Saudi central bank. Covers SAMA CSF 1.0 (May 2017) and subsequent CSF updates, IT-governance and outsourcing circulars, with maturity scoring against the four-tier SAMA scale.
- SAMA Cyber Security Framework 1.0 (May 2017)
- SAMA IT Governance + Outsourcing circulars (latest published version)
- SAMA Business Continuity Management Framework
- SAMA Counter-Fraud Framework
- SAMA Open Banking framework (where applicable)
- NCA Essential Cyber Controls (ECC-2:2024) overlay
- PCI DSS v4.0 (mapped for card-handling banks)
- ISO 27001:2022 (mapped)
Compliance is leverage, not paperwork.
The SAMA Cyber Security Framework (1.0, May 2017) and its later updates set the cybersecurity expectations for all entities under SABB / SAMA — banks, insurers, finance companies and payment service providers — graded on a four-tier maturity scale. SAMA inspections evaluate evidence against each control, and the central bank uses the maturity score as input to supervisory ratings. Macksofy's SAMA CSF audit is sequenced the way SAMA inspectors read it — control statements, sampled evidence, maturity score and a clean closure plan.
- Saudi licensed banks (local and foreign branches)
- Insurance and reinsurance companies under SAMA
- Finance companies and consumer-credit entities
- Payment service providers and Saudi Payments participants
- Major third-party suppliers to SAMA-regulated entities
- Fintechs licensed under SAMA's Regulatory Sandbox graduating to full licence
Aligned to the regulations that matter.
How we run a SAMA CSF engagement.
Interactive walkthrough — every phase clickable, every activity documented, every artefact regulator-ready.
1 · Scoping + tiering
- Entity-type + size classification
- Critical-service inventory
- Target-maturity tier confirmation
Everything you need to satisfy auditors.
- SAMA CSF scoping + tier memo
- Control-by-control compliance register
- Maturity heatmap on SAMA four-tier scale
- Technical validation report (VAPT + config audit)
- Third-party + outsourcing risk pack
- SAMA submission pack + inspector Q&A deck
- Closure tracker + annual recertification plan
SAMA CSF audit + maturity uplift
Outcome: Maturity score lifted from Tier-2 to Tier-3 across all four domains in one audit cycle; SAMA inspection closed with no major findings
SAMA CSF + NCA ECC-2 unified program
Outcome: Single control set covered both regimes; audit effort reduced by an estimated 30% in year two
The shape of a SAMA CSF engagement.
Every number below is grounded in how Macksofy actually runs the engagement — not aspirational marketing copy.
What we actually examine.
Each pillar is a distinct workstream inside the engagement — scoped, evidenced, and signed off independently before the audit pack is assembled.
- Leadership & governance3 pts
- Risk & compliance3 pts
- Operations & technology3 pts
- Third-party cyber security3 pts
- Maturity scoring3 pts
- SAMA submission pack3 pts
Board, cyber-committee and CISO accountability validated against SAMA expectations.
- Board-approved cyber-security policy
- CISO charter + reporting independence
- Cyber-risk metrics at board level
Risk register, regulatory mapping and compliance evidence walked end-to-end.
- Cyber-risk-management framework
- Regulatory compliance register
- Internal audit + assurance cadence
The largest control family in SAMA CSF — operational and technical controls.
- Identity, MFA + privileged-access
- Network + endpoint + cloud baselines
- SOC + 24x7 monitoring evidence
Outsourcing, supplier and cloud-provider cyber controls SAMA samples aggressively.
- Supplier risk + contract clauses
- Cloud + outsourcing due diligence
- Concentration-risk register
Four-tier maturity score per control — the metric SAMA inspectors anchor on.
- Per-control maturity rating
- Target-tier gap analysis
- Investment plan by tier delta
Artefacts assembled exactly the way SAMA inspections consume them.
- Control-statement to evidence map
- Maturity-heatmap deck
- Inspector Q&A walk-through
From kick-off to regulator-ready report.
The horizontal flow below shows the typical week-by-week shape of a SAMA CSF engagement. Click any station for detail in the methodology section above.
Rated 4.9 ★ from 612 client reviews.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
Things compliance leads ask before signing.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- 20,000+ professionals trained
- India + UAE engagements