Who Needs a SAMA CSF Assessment?
The SAMA Cyber Security Framework applies to member organizations regulated by the Saudi Central Bank, including:
Banks Operating in Saudi Arabia
Insurance and Reinsurance Companies
Finance and Leasing Companies
Payment Service Providers and E-Wallets
Credit Bureaus
Other SAMA-Regulated Member Organizations
Our SAMA CSF Assessment Approach
Assessor-led support from scoping and maturity scoring through gap closure planning and reporting.
Deliverables You Can Expect
Scored reports and roadmaps mapped to SAMA Cyber Security Framework domains and maturity levels.
SAMA CSF Scope & Applicability Summary
Domain-Wise Maturity Assessment
Maturity Scorecard (Level 0 to 5)
Control Gap Register
Prioritized Remediation Roadmap
Executive & Board Summary
Benefits of a SAMA CSF Maturity Assessment
Clear Maturity Baseline
Shows your current maturity level across every framework domain.
Focused Remediation
Targets the controls that keep you below the expected maturity level.
Supervisory Readiness
Prepares evidence and documentation ahead of SAMA supervisory reviews.
Board-Level Visibility
Gives leadership a concise, scored view of cyber security maturity.
Third-Party Risk Insight
Highlights gaps in outsourcing and vendor cyber security controls.
Progress Tracking
Creates a repeatable baseline to measure improvement over time.
Why Financial Institutions Choose QRC
Independent assessment backed by financial-sector audit experience. Financial-Sector Assurance PCI QSA company with assurance experience across banks and payment providers. Maturity-Based Methodology Assessments scored against the framework's maturity model, not a simple checklist.
PCI QSA company with assurance experience across banks and payment providers.
Assessments scored against the framework's maturity model, not a simple checklist.
Vulnerability assessment and penetration testing by QRC's own teams.
Clear scoping, evidence review, scoring and remediation tracking.
Supporting Services
Services that strengthen your cyber security posture alongside the SAMA CSF assessment.
Vulnerability Assessment
Identify weaknesses across infrastructure and applications that support regulated services.
Learn More
Penetration Testing
Test internet-facing and internal systems for exploitable vulnerabilities.
Learn More
SOC Monitoring
Continuous monitoring and alerting to support security operations and incident detection.
Learn MoreFrequently Asked Questions
The SAMA Cyber Security Framework (CSF) is issued by the Saudi Central Bank for its regulated member organizations. It sets cyber security requirements across four domains: leadership and governance, risk management and compliance, operations and technology, and third-party security.
No. It applies to organizations regulated by SAMA, such as banks, insurers, finance companies, payment service providers and credit bureaus. Other organizations may fall under different requirements, such as those issued by the National Cybersecurity Authority.
The framework uses a maturity model from Level 0 to Level 5. Member organizations are generally expected to reach at least Level 3 (structured and formalized) across the framework.
Timing depends on your license type, the number of entities and systems in scope, and evidence availability. QRC confirms a realistic timeline after the initial scoping discussion.
ISO/IEC 27001 is an international, voluntary management system standard. SAMA CSF is a regulatory framework for the Saudi financial sector with its own maturity expectations, though ISO 27001 evidence can support parts of it.
Ready to Start Your SAMA CSF Assessment?
Get the right scope, clear next steps, and a structured path toward the expected maturity level.