Overview

SAMA CSF — SAMA Cyber Security Framework

MAST Consulting Group delivers full SAMA CSF programmes — gap assessment, implementation, internal audit and certification support — for regulated enterprises across the UAE, KSA, India and Africa.

ISO/IEC 27001 Certified
ISO/IEC 27701 Certified
ISO 9001 Certified

Delivered by an ISO/IEC 27001, 27701 & 9001 certified organisation

What is SAMA CSF?

The SAMA Cyber Security Framework defines cybersecurity expectations for banks, insurers and payment service providers regulated by the Saudi Central Bank.

Who needs to comply

Saudi-licensed entities within the regulator's perimeter
Government bodies, GREs and critical-sector operators
Service providers processing Saudi resident data
Foreign processors falling under extra-territorial scope

Why it matters now

Regulators, customers and partners increasingly require evidence of an attested control set.
SAMA CSF provides a defensible baseline that maps cleanly into adjacent frameworks.
A single control set serves multiple audits, reducing cost and audit fatigue.
Boards and audit committees expect quantified, ongoing assurance — not point-in-time reports.

Audit overlap reduction

Less audit fatigue

Clients running SAMA CSF alongside adjacent frameworks typically see a 30–40% reduction in duplicated evidence work.

How MAST helps

Lead Auditor and Lead Implementer-certified consultants for SAMA CSF.
Local delivery in the UAE, KSA and India with on-site and remote options.
Templates, accelerators and a unified control catalogue that map across frameworks.
Managed-service options for continuous compliance after certification.

Why MAST for SAMA CSF

Lead Auditor and Lead Implementer-certified consultants for SAMA CSF.
Local delivery in the UAE, KSA and India with on-site and remote options.
Templates, accelerators and a unified control catalogue that map across frameworks.
Managed-service options for continuous compliance after certification.

Scope & boundaries

Defining the right scope is the single biggest determinant of SAMA CSF success. Too narrow and the certificate is meaningless to buyers; too broad and the programme stalls under its own weight. The boundary below is our starting point and is tuned to each client during a two-week scoping sprint.

Legal entities, business units and brands in scope
Geographies, data residency boundaries and cross-border flows
Cloud accounts, on-premise estates and end-user computing devices
In-scope products, services or customer segments — and the data they process
Third parties and sub-processors handling in-scope data on your behalf
Shared services (identity, HR, payroll, finance) that touch the in-scope estate

Key controls & requirements

SAMA CSF is structured around the control families below. MAST maintains a unified control catalogue that maps each requirement to your existing controls, so one implementation satisfies multiple audits.

Cyber Security Leadership and Governance
Cyber Security Risk Management and Compliance
Cyber Security Operations and Technology
Third Party Cyber Security

Compliance steps

A pragmatic 12 to 16 week roadmap from gap to audit-ready SAMA CSF. Compresses for smaller scopes and extends for multi-entity programmes; every stage ends with a formal gate review.

Stage	Duration	Outcome
1. Mobilise	Week 1	Sponsor confirmed, charter signed, scope statement agreed
2. Gap assess	Weeks 2–3	Current-state maturity heatmap and prioritised remediation backlog
3. Design	Weeks 4–6	Policies, control matrix, risk treatment plan, Statement of Applicability
4. Implement	Weeks 6–12	Controls live, evidence captured, workforce trained, internal awareness done
5. Internal audit	Weeks 12–14	Independent audit report, findings closed, management review minuted
6. External audit	Weeks 14–16	Stage 1 readiness review and Stage 2 / certification audit for SAMA CSF
7. Sustain	Ongoing	Surveillance audits, continuous monitoring and annual management review

Common pitfalls — and how we avoid them

The failure patterns we see most often on SAMA CSF programmes. None are about the standard itself — they are about how it is run.

NCA ECC compliance level claimed without evidence of the third-party annual assessment NCA expects.
SAMA CSF maturity self-assessed at level 3 without the operating evidence to support continuous improvement.
Cloud workloads moved abroad without addressing CST CCRF residency and classification requirements.
KSA PDPL transfer mechanisms relied on adequacy without confirming SDAIA's current adequacy list.
OT environments in scope for NCA OTCC excluded from the cyber programme because they sit under operations, not IT.
Incident reporting timelines (SAMA, NCA) missed because IR plans were written in English and never translated for the SOC.

Go deeper