Bahriya Tersane

Convoys · Compliance and Assurance · SAMA CSF

SAMA Cyber Security Framework. Coming soon

Expected Q1 2027. Saudi Arabia. Regulator: Saudi Central Bank (SAMA).

The convoy's regime for banks and financial institutions in Saudi Arabia. It will map each control consideration of the Saudi Central Bank's framework to the evidence a Kubernetes cluster can show, beside NCA ECC in the same installation, so a bank that answers to both regulators scans its cluster once.

This regime is in preparation. The structure below is taken from SAMA's framework; how each control consideration will be evidenced is planned, and is confirmed when the regime is released.

Who it applies to

Banks and financial institutions regulated by SAMA.

The Cyber Security Framework is issued by the Saudi Central Bank and applies to the organisations it regulates in Saudi Arabia: banks, insurance and reinsurance companies, financing companies, credit bureaus and financial market infrastructure. SAMA publishes it openly in its Rulebook.

A bank in Saudi Arabia that also falls under NCA's Essential Cybersecurity Controls answers to two regulators. With both regimes selected, the convoy scans the cluster once and reports each regime from the same evidence, in its own numbering.

Structure

Four domains, 32 subdomains.

Each subdomain of the framework sets a principle and an objective, and then a list of control considerations, numbered in up to four levels. The convoy maps each control consideration at the level SAMA numbers it last, so a subdomain that mixes what a cluster can show with what it cannot does not collapse into a single partial result.

  1. 3.1 Leadership and governance 7
  2. 3.2 Risk management and compliance 5
  3. 3.3 Operations and technology 17
  4. 3.4 Third parties 3
The framework's four domains, with the number of subdomains in each: 32 in all.

Evidence, as planned

Evidence for each consideration, and no maturity score.

  • Enforced, checked and platform (planned). Nine of the 32 subdomains have a part a cluster can show: asset management, security architecture, identity and access management (including multi-factor authentication for remote and privileged access), application security, change management, infrastructure security and network segmentation, cryptography, security event management, and vulnerability management. Within them, the technical considerations are classed as for every regime, and the report asks for the institution's evidence of the rest.
  • The institution's evidence (planned). Leadership and governance, risk management and compliance, people, physical security and third parties are the institution's to evidence, and the report will list each as such.
  • Not applicable, with the reason. SAMA's requirements for cloud computing apply to hybrid and public cloud. For a cluster on the institution's own premises they are reported as not applicable, with that reason, and never left out.
  • No invented thresholds. The framework sets no retention period for event logs, so the convoy reports the period configured and judges it against none.

SAMA assesses each subdomain on a maturity scale. The convoy reports the evidence for each consideration and does not score maturity: the maturity level is the institution's to determine, and the evidence is not a level.

An example of the report format: the opening of the convoy's report for NCA ECC-2:2024, with the run's date and cluster, the statement that the report records technical evidence and does not state compliance, and the requirements counted by result.
An example of the report format, from the convoy's first regime, NCA ECC-2:2024, on a test cluster. The SAMA CSF report will take the same form, in SAMA's numbering.

The mapping

Mamluk's mapping, keyed to NIST.

Each requirement is mapped to the NIST SP 800-53 Rev. 5 controls it corresponds to, and each NIST control to the checks that evidence it in the cluster. The checks and their NIST mapping are shared by every regime, so a cluster is scanned once and each regime selected is reported from the same evidence, in its regulator's own numbering.

SAMA states that its framework draws on NIST, ISO, the Information Security Forum, Basel and PCI DSS, but it publishes no mapping of its control considerations to any of them.

The regulator publishes no official crosswalk to NIST, so the mapping is Mamluk's own. Before the regime is released, it is checked against the regulator's text a second time, by a reviewer other than its author.

The mapping is Mamluk's, and the report says so. It records the technical evidence the cluster provides; it does not make an organisation compliant, and compliance is determined by your assessor.

Regimes

One convoy, every regime.

Every regime runs in the same installation of the convoy. An organisation that answers to two regulators selects both, and each is licensed separately. The convoy is experimental; the regimes not yet available are coming soon.

Price and availability

Each regime is licensed at USD 24,000 per organisation, per year, with the Tersane core licence; there is no base fee. The convoy needs Kubernetes 1.36 or later, which BKE provides from 2.2.0. See the Compliance and Assurance Convoy for how it works, and its documentation for installation.

Discuss SAMA CSF

To discuss the regimes your organisation must meet, or the convoy's licensing, contact Mamluk.

Contact Mamluk