SAMA Cyber Security Framework with Maturity Scoring
The Saudi Central Bank's Cyber Security Framework applies to banks, insurers and other regulated financial institutions in Saudi Arabia. It is assessed by maturity level, not pass or fail.
CAPA-21Cyber Security Leadership and GovernanceIn progressCAPA-24Cyber Security Operations and TechnologyOverdueHow SAMA CSF Is Organised in Arbor
SAMA CSF loads with its domains, ready to assign and assess.
- 01Cyber Security Leadership and Governance
- 02Cyber Security Risk Management and Compliance
- 03Cyber Security Operations and Technology
- 04Third Party Cyber Security
What Arbor Does with SAMA CSF
- All domains and subdomains loaded
- Maturity scored per control and rolled up by domain
- Gaps tracked to closure as corrective actions
No Clause Numbers to Memorise
Arbor AI suggests the SAMA CSF requirements that apply as you work.
SAMA CSF in Four Steps
Load
SAMA CSF loads with its full structure, kept up to date by our team.
Set Scope
Decide what applies and record the reason.
Assess
Assign owners, score each requirement and link evidence.
Prove
Close gaps with corrective actions and report with confidence.
Do the Work Once for SAMA CSF
Where controls overlap, shared evidence counts toward related frameworks, so nothing is done twice.
Frequently Asked Questions
Is SAMA CSF Kept Up to Date?
Yes. Our team loads SAMA CSF and updates it when the standard changes.
Can We Import Our Existing SAMA CSF Assessment?
Yes. Use the Excel template and Arbor checks every row before it loads.
Can SAMA CSF Share Evidence with Other Frameworks?
Yes. Evidence is uploaded once and linked to every requirement it supports.
See SAMA CSF in Arbor GRC
Bring your current risk register. We can import it from Excel during the demo, so you see your own risks in Arbor, not ours.