SAMA Cyber Security Framework
The Saudi Central Bank's cyber security framework for the financial sector, applied to the institutions it supervises.
NUEXUS delivers readiness, gap assessment, implementation support and evidence preparation. NUEXUS is not an accredited certification body and not an auditor, and cannot certify you, issue an attestation, or sign off on a result.
How it is organised
Supervisory, with maturity expectations
The framework is issued by the supervisor and assessed against maturity rather than a simple pass or fail. That changes the work: the question is not only whether a control exists but whether it is defined, operating, measured and improving.
Governance sits above the technical controls
Board and senior management accountability is explicit. A programme run entirely from within IT tends to score poorly regardless of technical quality, because the evidence of ownership is missing.
Third parties are in scope through you
Outsourced and cloud arrangements remain the institution's responsibility. The supervisor's interest does not stop at your perimeter, which is why supplier assurance work usually starts here.
What an assessor will ask to see
- Board-level approval and reporting, minuted
- Maturity assessment against each domain with evidence per level claimed
- Risk register tied to business services rather than to systems alone
- Third-party assurance covering the arrangements that matter
- Incident response evidence, including exercises
Where it usually goes wrong
- Maturity self-assessed higher than the evidence supports
- Security reporting that never reaches the board in a form it can act on
- Outsourced services assumed to be the provider's problem
- Exercises run but not documented to a standard the supervisor accepts